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Highlights 

Highlights  of  GAO-14-60,  a  report  to 
congressional  committees 


DOD  FINANCIAL  MANAGEMENT 

Improvements  Needed  in  Army's  Efforts  to  Ensure  the 
Reliability  of  Its  Statement  of  Budgetary  Resources 


Why  GAO  Did  This  Study 

The  National  Defense  Authorization 
Act  for  Fiscal  Year  2013  requires  the 
Department  of  Defense  (DOD)  to 
describe  how  its  SBR  will  be  validated 
as  ready  for  audit  by  September  30, 
2014.  The  DOD  Comptroller  issued  the 
FIAR  Guidance  to  provide  a  standard 
methodology  for  DOD  components  to 
use  to  develop  and  implement  FIPs, 
improve  financial  management,  and 
achieve  audit  readiness.  The  Army’s 
FIP  for  budget  execution  provides  a 
framework  for  planning,  executing,  and 
tracking  essential  steps  with  supporting 
documentation  to  achieve  audit 
readiness  of  its  General  Fund  SBR. 

GAO  is  mandated  to  audit  the  U.S. 
government’s  consolidated  financial 
statements,  including  activities  of 
executive  branch  agencies  such  as 
DOD.  This  report  identifies  the  extent 
to  which  the  Army  developed  and 
implemented  its  General  Fund  SBR 
FIP  for  budget  execution  in  accordance 
with  the  FIAR  Guidance  with  regard  to 
(1 )  determining  the  scope  of  activities 
included  in  the  FIP  and  (2)  completing 
those  activities  included  in  the  scope  of 
the  FIP.  GAO  reviewed  the  Army’s  FIP 
to  determine  whether  it  contained  the 
elements  required  by  the  FIAR 
Guidance  and  reviewed  test  results, 
status  reports,  and  other  deliverables. 

What  GAO  Recommends 

GAO  recommends  that  among  other 
things,  the  Army  take  steps  to  improve 
implementation  of  the  FIAR  Guidance 
for  its  General  Fund  SBR  FIP  for 
budget  execution  and  ensure  that  all 
significant  SBR  processes,  systems, 
and  risks  are  adequately  considered 
and  identified  deficiencies  are 
resolved.  The  Army  concurred  with 
GAO’s  recommendations. 

View  GAO-14-60.  For  more  information, 
contact  Asif  A.  Khan  at  (202)  512-9869  or 
khana@gao.gov. 


What  GAO  Found 


The  Army  has  made  important  progress  in  developing  its  financial  improvement 
plan  (FIP)  for  budget  execution  to  help  guide  its  General  Fund  Statement  of 
Budgetary  Resources  (SBR)  audit  readiness  efforts.  This  FIP  covers  current  year 
activity  associated  with  the  recently  deployed  General  Fund  Enterprise  Business 
System  (GFEBS)  emphasizing  the  implementation  of  effective  business 
processes.  However,  the  Army  did  not  fully  complete  certain  tasks  in  accordance 
with  the  Financial  Improvement  and  Audit  Readiness  (FIAR)  Guidance  to  ensure 
that  its  FIP  adequately  considered  the  scope  of  efforts  required  for  audit 
readiness.  For  example,  the  Army  did  not  consider  the  risks  associated  with 
excluding  current  year  activity  associated  with  legacy  systems  and  did  not 
adequately  identify  significant  SBR  activity  attributable  to  service  provider 
business  processes  and  systems.  These  activities  may  continue  to  represent 
material  portions  of  future  SBRs  and,  if  not  auditable,  will  likely  affect  the  Army’s 
ability  to  achieve  audit  readiness  goals  as  planned. 

For  GFEBS-related  audit  readiness  activities  within  the  scope  of  its  FIP  for 
budget  execution,  the  Army  documented  controls  in  narratives  and  flowcharts 
and  performed  monthly  tests  to  assess  their  effectiveness.  Based  on  test  results 
from  June  2012  through  May  2013,  the  Army  identified  extensive  deficiencies, 
such  as  lack  of  appropriate  reviews  or  approvals,  and  had  an  average  failure  rate 
of  56  percent. 


Army’s  Reported  SBR  Internal  Control  Test  Failure  Rates  for  Commands  Tested 
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Source:  GAO  analysis  of  Army  Leadership  Briefs,  June  2012  through  May  2013. 

The  Army  did  not  fully  follow  the  FIAR  Guidance  in  performing  the  tasks  required. 
For  example,  the  Army’s  documentation  and  assessment  of  controls  were  not 
always  complete  or  accurate.  Further,  extensive  deficiencies  identified  by  Army 
had  not  been  remediated  prior  to  an  independent  public  accountant’s  (IPA) 
examination  of  its  audit  readiness  efforts. 


Overall,  the  gaps  and  deficiencies  identified  above  are  largely  due  to  the  Army’s 
focus  on  (1)  the  audit  readiness  of  new  GFEBS  processes  despite  continued 
reliance  on  legacy  systems  and  service  providers  and  (2)  asserting  audit 
readiness  before  correcting  extensive  control  deficiencies.  Army  officials  cited 
adherence  to  assertion  and  IPA  examination  milestones  as  essential.  However, 
this  approach  raises  serious  concerns  regarding  the  likelihood  that  SBR  audit 
readiness  will  occur  as  planned  and  the  Army’s  ability  to  ensure  the  accuracy  of 
financial  information  used  to  monitor  budgetary  resources  to  achieve  its  mission. 
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Abbreviations 

CAP 

corrective  action  plan 

DFAS 

Defense  Finance  and  Accounting  Service 

DOD 

Department  of  Defense 

ERP 

enterprise  resource  planning 

FBWT 

Fund  Balance  with  Treasury 

FIAR 

Financial  Improvement  and  Audit  Readiness 

FIP 

financial  improvement  plan 

FORSCOM 

Forces  Command 

GFEBS 

General  Fund  Enterprise  Business  System 

ICOFR 

Internal  Control  over  Financial  Reporting 

IMCOM 

Installation  Management  Command 

IPA 

independent  public  accountant 

MOU 

memorandum  of  understanding 

NDAA 

National  Defense  Authorization  Act 

OIG 

Office  of  Inspector  General 

OUSD(C) 

Office  of  the  Under  Secretary  of  Defense  (Comptroller) 

SBA 

Schedule  of  Budgetary  Activity 

SBR 

Statement  of  Budgetary  Resources 

SOA 

Statement  of  Assurance 

SSAE 

Statement  on  Standards  for  Attestation  Engagements 

TRADOC 

Training  and  Doctrine  Command 
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GAO 

441  G  St.  N.W. 
Washington,  DC  20548 


U.S.  GOVERNMENT  ACCOUNTABILITY  OFFICE 


May  30,  2014 

The  Honorable  Thomas  R.  Carper 
Chairman 

The  Honorable  Tom  Coburn,  M.D. 

Ranking  Member 

Committee  on  Homeland  Security  and  Governmental  Affairs 
United  States  Senate 

The  Honorable  Darrell  E.  Issa 
Chairman 

The  Honorable  Elijah  Cummings 
Ranking  Member 

Committee  on  Oversight  and  Government  Reform 
House  of  Representatives 

The  U.S.  Army  is  the  largest  component  within  the  Department  of 
Defense  (DOD),  accounting  for  about  $189  billion  or  30  percent  of  DOD’s 
total  reported  expenditures  for  fiscal  year  201 3. 1  DOD  has  been  unable  to 
prepare  auditable  information  for  department-wide  financial  statements  as 
required  by  the  Government  Management  Reform  Act  of  1994. 2  Over  the 
years,  we  have  reported  on  the  Army  and  other  DOD  efforts  to  overcome 
long-standing  financial  management  weaknesses  that  have  prevented  the 
issuance  of  auditable  financial  statements.  Pervasive  financial  and  related 
business  management  systems  and  control  weaknesses  have  adversely 
affected  DOD’s  ability  to  control  costs;  ensure  basic  accountability; 
anticipate  future  costs  and  claims  on  the  budget;  measure  performance; 
maintain  funds  control;  prevent  and  detect  fraud,  waste,  and  abuse; 
address  pressing  management  issues;  and  prepare  auditable  financial 
statements.  These  issues  led  GAO  to  designate  DOD  financial 
management  as  high  risk  since  1995. 3 


fiscal  year  2013,  the  Army  represented  5  percent  of  the  U.S.  government’s  total 
reported  expenditures  of  $3.5  trillion.  The  Army  operates  through  23  commands  and  direct 
reporting  units,  including  foreign  military  operations  in  Iraq  and  Afghanistan,  with  a 
component  strength  of  over  1.1  million  uniformed  servicemembers,  about  270,000  civilian 
employees,  and  thousands  of  contract  employees. 

2Pub.  L.  No.  103-356,  §405  (Oct.  13,  1994),  codified  as  amended  at  31  U.S.C.  §3515. 

3GAO,  High-Risk  Series:  An  Update ,  GAO-13-283  (Washington,  D.C.:  February  2013). 
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The  National  Defense  Authorization  Act  (NDAA)  for  Fiscal  Year  201 04 
requires  that  DOD  develop  and  maintain  the  Financial  Improvement  and 
Audit  Readiness  (FIAR)  Plan,  which  includes,  among  other  things,  the 
specific  actions  to  be  taken  and  costs  associated  with  correcting  the 
financial  management  deficiencies  that  impair  its  ability  to  prepare  timely, 
reliable,  and  complete  financial  management  information  and  ensuring 
that  its  financial  statements  are  validated  as  ready  for  audit  by 
September  30,  201 7. 5  Since  DOD  management  relies  heavily  on  budget 
information  for  day-to-day  management  decisions,  the  DOD  Comptroller 
designated  the  Statement  of  Budgetary  Resources  (SBR)  as  an  audit 
priority.6  The  Secretary  of  Defense  underscored  the  department’s  SBR 
priority  with  an  October  201 1  memorandum  directing  the  Under  Secretary 
of  Defense  (Comptroller)  to  provide  a  revised  plan  for  achieving  audit 
readiness  of  the  SBR  by  September  30,  2014,  with  the  aim  to  provide 
DOD  managers  with  auditable  General  Fund  information  to  track 
spending,  identify  waste,  and  improve  DOD’s  business  processes.7 
Subsequently,  the  NDAA  for  Fiscal  Year  2013  amended  the  legal 
requirement  to  add  that  the  FIAR  Plan’s  financial  management 
improvement  efforts  should  also  support  the  goal  of  validating  the  audit 
readiness  of  DOD’s  SBR  no  later  than  September  30,  2014. 


4Pub.  L.  No.  111-84,  div.  A,  §  1003(a),  (b)  (Oct.  28,  2009). 

5To  be  ready  for  an  audit,  entities  must  be  able  to  provide  sufficient  evidence  and  other 
information  such  that  the  auditor  is  able  to  (1)  obtain  reasonable  assurance  about  whether 
the  financial  statements  are  presented  fairly,  in  all  material  respects,  in  conformity  with 
United  States  generally  accepted  accounting  principles;  (2)  obtain  a  sufficient 
understanding  of  internal  control  over  financial  reporting  and  compliance  to  plan  the  audit; 
and  (3)  perform  tests  regarding  compliance  with  certain  laws  and  regulations  and  other 
procedures.  Further,  the  NDAA  for  Fiscal  Year  2014,  Pub.  L.  No.  113-66,  div.  A,  §  1003 
(Dec.  26,  201 3)  also  mandates  a  full  audit  of  DOD’s  fiscal  year  2018  financial  statements, 
and  that  those  results  be  submitted  to  Congress  by  March  31, 2019. 

6The  SBR  and  related  disclosures  provide  information  about  budgetary  resources  made 
available  to  an  agency  as  well  as  the  status  of  those  resources  at  the  end  of  the  fiscal 
year. 

7The  Army’s  General  Fund  includes  appropriated  funding  for  military  and  civilian  payroll, 
facility  operations  and  maintenance,  various  overseas  operations,  procurement,  research 
and  development,  and  military  construction.  It  does  not  include  the  Army’s  Working 
Capital  Fund,  which  is  funded  primarily  from  fees  charged  for  goods  and  services  provided 
to  customers.  Business  processes  consist  of  a  sequence  of  activities  that  are  performed  in 
order  to  accomplish  work  and  achieve  the  business’s  objectives. 
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To  facilitate  efforts  to  meet  these  requirements,  the  DOD  Comptroller 
issued  the  FIAR  Guidance,  which  defines  DOD’s  strategy,  goals,  roles 
and  responsibilities,  and  procedures  for  the  components  to  become  audit 
ready.8  Specifically,  the  guidance  provides  a  standard,  multiphased 
methodology  that  DOD  components  are  required  to  follow  in  developing 
and  implementing  financial  improvement  plans  (FIP).  These  plans,  in  turn, 
provide  a  framework  for  planning,  executing,  and  tracking  essential  steps 
with  supporting  documentation  to  achieve  auditability.  However,  the 
results  of  our  prior  work  have  raised  concerns  about  the  ability  of  DOD 
components  to  effectively  implement  the  FIAR  Guidance.9 

Components  may  develop  multiple  FIPs  to  manage  portions  of  their 
improvement  efforts — such  as  those  related  to  specific  assessable 
units.10  The  Army’s  approach  for  achieving  General  Fund  SBR  audit 
readiness  is  intended  to  integrate  various  interrelated  efforts  to  improve 
business  processes  and  systems  and  includes  separate  FIPs  for  budget 
execution,  military  pay,  financial  reporting,  and  Fund  Balance  with 


8Underthe  FIAR  Guidance,  DOD  components  include  reporting  entities  (i.e.,  DOD  entities 
or  funds  that  prepare  stand-alone  financial  statements  included  in  the  DOD-wide  financial 
statements)  and  service  providers  that  provide  a  variety  of  accounting,  personnel, 
logistics,  systems,  or  other  support  services.  Further,  audit  readiness  assertions  specify 
that  (1)  control  activities  are  suitably  designed  and  implemented,  operating  effectively,  and 
sufficiently  documented  to  provide  reasonable  assurance  that  applicable  financial 
reporting  objectives  are  achieved;  (2)  key  supporting  documents  are  readily  available  for 
review;  and  (3)  account  balances  and  transactions  are  accurately  recorded. 

9GAO,  DOD  Financial  Management:  Improvement  Needed  in  DOD  Components’ 
Implementation  of  Audit  Readiness  Effort,  GAO-11-851  (Washington,  D.C.:  Sept.  13, 

201 1 ),  and  DOD  Financial  Management:  Ongoing  Challenges  with  Reconciling  Navy  and 
Marine  Corps  Fund  Balance  with  Treasury,  GAO-12-132  (Washington,  D.C.:  Dec.  20, 
2011). 

i  n 

According  to  the  FIAR  Guidance,  components  are  required  to  establish  assessable  units 
for  all  processes,  systems,  or  classes  of  assets  that  result  in  material  transactions  and 
balances  in  their  financial  statements  to  help  focus  their  improvement  efforts.  For 
example,  assessable  units  may  represent  business  processes  associated  with  specific 
functions  (e.g.,  civilian  pay)  or  financial  activity  associated  with  specific  systems  (e.g.,  the 
Army’s  General  Fund  Enterprise  Business  System). 
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Treasury  (FBWT).11  The  Army’s  FIP  for  budget  execution  is  particularly 
important  as  it  addresses  improvement  efforts  across  multiple  business 
processes,  including  funds  distribution,  contracts,  temporary  duty  travel, 
miscellaneous  payments,  government  purchase  cards,  supply, 
reimbursements,  and  civilian  pay.  Budgetary  resources  and  financial 
activity  (e.g.,  obligations  and  expenditures)  associated  with  these 
processes  represent  significant  portions  of  amounts  reported  on  the 
Army’s  General  Fund  SBR.  Consequently,  efforts  to  develop  and 
implement  this  FIP  will  significantly  affect  the  Army’s  ability  to  achieve 
audit  readiness. 

This  report  was  initiated  under  our  mandate  to  audit  the  U.S. 
government’s  consolidated  financial  statements,12  including  activities  of 
executive  branch  agencies  such  as  DOD.  Serious  financial  management 
problems  at  DOD  represent  one  of  the  long-standing  major  impediments 
that  continue  to  prevent  GAO  from  expressing  an  audit  opinion  on  the 
U.S.  government’s  consolidated  financial  statements.13  We  focused  on 
the  Army’s  General  Fund  SBR  budget  execution  FIP  because  of  its 
importance  to  the  Army’s  effort  to  achieve  SBR  auditability  and, 
ultimately,  audit  readiness  for  DOD’s  department-wide  SBR.  Our 
objectives  were  to  determine  the  extent  to  which  the  Army  developed  and 
implemented  its  General  Fund  SBR  FIP  for  budget  execution  in 
accordance  with  the  FIAR  Guidance  with  regard  to  (1)  determining  the 
scope  of  activities  included  in  the  FIP  and  (2)  completing  those  activities 
included  in  the  scope  of  the  FIP.  To  address  our  objectives,  we  analyzed 
the  Army’s  FIP  to  determine  whether  it  contained  the  elements  and  tasks 
for  the  phases  of  audit  readiness  efforts  under  way  at  the  time  of  our 
review,  as  required  by  the  FIAR  Guidance.  We  also  identified  and 
reviewed  the  FIP  deliverables  required  by  the  FIAR  Guidance,  such  as 


11  Fund  Balance  with  Treasury  is  an  asset  account  representing  the  future  economic 
benefit  of  monies  that  an  agency  can  spend  for  authorized  transactions.  It  primarily 
consists  of  all  funds  on  deposit  with  the  Department  of  the  Treasury.  Federal  agencies  use 
this  account  to  record  appropriations,  receipts,  transfers,  and  disbursement  activity. 
According  to  the  Army’s  strategy  and  the  FIAR  Guidance,  the  Army  has  focused  audit 
readiness  efforts  on  its  General  Fund,  and  has  not  yet  finalized  its  strategy  for  achieving 
audit  readiness  for  its  Working  Capital  Fund,  which  reported  $13.7  billion  or  4.9  percent  of 
the  Army’s  total  budgetary  resources  for  fiscal  year  2013. 

1231  U.S.C.  §  331(e). 

13GAO,  Financial  Audit:  U.S.  Government’s  Fiscal  Years  2013  and  2012  Consolidated 
Financial  Statements,  GAO-14-319R  (Washington,  D.C.:  Feb.  27,  2014). 
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process  narratives  and  flowcharts,  internal  control  assessments,  and  test 
results.  In  addition,  we  reviewed  the  results  of  independent  public 
accountant  (IPA)  examinations  of  audit  readiness  efforts  related  to  the 
Army’s  FIP  for  budget  execution.  We  interviewed  Army,  Defense  Finance 
and  Accounting  Service  (DFAS),  and  FIAR  Directorate  officials  within 
DOD’s  Office  of  the  Under  Secretary  of  Defense  (Comptroller)  (OUSD(C)) 
to  obtain  explanations  and  clarifications  on  documentation  we  reviewed.14 

Further  information  on  our  scope  and  methodology  is  provided  in 
appendix  I.  We  conducted  this  performance  audit  from  June  2012  to  May 
2014  in  accordance  with  generally  accepted  government  auditing 
standards.  Those  standards  require  that  we  plan  and  perform  the  audit  to 
obtain  sufficient,  appropriate  evidence  to  provide  a  reasonable  basis  for 
our  findings  and  conclusions  based  on  our  audit  objectives.  We  believe 
that  the  evidence  obtained  provides  a  reasonable  basis  for  our  findings 
and  conclusions  based  on  our  audit  objectives. 


Background 


In  May  2010,  the  DOD  Comptroller  issued  the  FIAR  Guidance  to  provide 
a  standard  methodology  for  DOD  components  to  follow  in  developing  an 
audit  strategy  and  implementing  FIPs.  The  FIAR  Guidance  was  most 
recently  updated  in  November  2013  and  describes  the  following  five  audit 
readiness  phases  and  activities  that  DOD  reporting  entities  (including  the 
Army)  are  to  include  in  their  FIPs. 

•  Discovery  Phase:  Entities  document  their  processes  and  identify, 
test,  and  assess  their  controls  and  evaluate  and  confirm  the  existence 
of  documentation  supporting  relevant  financial  statement  assertions. 

•  Corrective  Action  Phase:  Entities  develop  and  execute  plans  to 
address  identified  deficiencies  and  verify  implementation  of  corrective 
actions. 

•  Assertion/Evaluation  Phase:  The  FIAR  Directorate  reviews 
assertions  by  entity  management  that  assessable  units  are  audit 


14The  FIAR  Directorate  provides  management  of  the  FIAR  Plan  to  ensure  integration  of 
DOD-wide  financial  improvement  efforts  through  various  activities,  including  (1)  the 
development  and  issuance  of  the  FIAR  Guidance,  (2)  performing  monthly  detailed  reviews 
of  component  FIPs  and  evaluating  related  deliverables,  and  (3)  the  development  of 
metrics  for  monitoring  and  progress  reporting. 
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ready.  An  IPA  or  the  DOD  Office  of  Inspector  General  (OIG)  examines 
readiness,  and  entity  management  addresses  any  reported 
deficiencies. 

•  Validation  Phase:  The  FIAR  Directorate  validates  audit  readiness 
based  on  its  assessment  of  the  IPA  examination  report  and 
documentation  supporting  successful  remediation  of  auditor-identified 
deficiencies. 

•  Audit  Phase:  An  IPA  or  the  DOD  OIG  performs  an  audit  of  the 
financial  statements  or  specified  elements  of  them  and  issues  an 
opinion  on  whether  they  are  fairly  presented  in  accordance  with 
generally  accepted  accounting  principles. 

Appendix  II  provides  more  specific  information  on  the  phases,  tasks,  and 
deliverables  that  the  FIAR  Guidance  requires  reporting  entities  to  include 
in  their  FIPs. 

In  response  to  component  difficulties  in  preparing  for  a  full  SBR  audit,  the 
November  2012  FIAR  Plan  Status  Report  and  the  March  2013  FIAR 
Guidance  included  a  revision  to  narrow  the  scope  of  initial  audits  to  only 
current  year  budget  activity  and  expenditures  on  a  Schedule  of  Budgetary 
Activity  (SBA).15  Under  this  approach,  beginning  in  fiscal  year  2015, 
reporting  entities  are  to  undergo  an  examination  of  their  SBAs  by  an  IPA 
or  the  DOD  OIG  reflecting  the  balances  and  associated  activity  related 
only  to  funding  approved  on  or  after  October  1,  2014.  As  a  result,  SBAs 
will  exclude  unobligated  and  unexpended  amounts  carried  over  from  prior 
years’  funding  as  well  as  information  on  the  status  and  use  of  such 
funding  in  subsequent  years  (e.g.,  obligations  incurred  and  outlays).16 
These  amounts  will  remain  unaudited.  Over  the  ensuing  years,  as  the 


15DOD’s  FIAR  Plan  Status  Reports  describe  the  status  of  FIAR  Plan  implementation  and, 
as  required  by  the  NDAA  for  Fiscal  Year  2010,  Pub.  L.  No.  111-84,  §  1003(b),  are 
submitted  to  Congress  semiannually  by  May  15  and  November  15.  As  amended  by  the 
NDAA  for  Fiscal  Year  2013,  Pub.  L.  No.  112-239,  div.  A,  §  1005(a)  (Jan.  2,  2013),  the 
FIAR  Plan  is  statutorily  required  to  “describe  specific  actions  to  be  taken  and  the  costs 
associated  with  .  .  .  ensuring  ...  the  statement  of  budgetary  resources  of  the  Department 
of  Defense  is  validated  as  ready  for  audit  by  not  later  than  September  30,  2014.” 

16Unobligated  amounts  are  the  cumulative  portion  of  an  entity’s  obligation  authority  that 
has  not  yet  been  obligated.  Obligations  incurred  include  the  amounts  of  orders  placed, 
contracts  awarded,  services  received,  and  similar  transactions  during  a  given  period. 
Obligations  are  usually  liquidated  by  payments  (outlays).  Unexpended  amounts  represent 
unobligated  funds  or  obligated  amounts  that  have  not  yet  been  liquidated. 
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unaudited  portion  of  SBR  balances  and  activity  related  to  this  funding 
decline,  the  audited  portion  is  expected  to  increase.  The  NDAA  for  Fiscal 
Year  2010,  as  amended  by  the  NDAA  for  Fiscal  Year  2013,  requires  that 
the  FIAR  Plan  describe  specific  actions  to  be  taken  and  the  costs 
associated  with  ensuring  that  DOD’s  SBR  is  validated  as  ready  for  audit 
by  not  later  than  September  30,  2014.  Further,  the  FIAR  Plan  Status 
Report  is  required  to  include  a  determination  by  the  Chief  Management 
Officer  of  each  military  department  concerning  its  ability  to  achieve  an 
auditable  SBR  by  September  30,  2014,  and  if  the  department  is  unable  to 
meet  this  deadline,  an  explanation  as  to  why  it  is  unable  to  meet  the 
deadline  as  well  as  an  alternative  deadline  and  a  description  of  the  plan 
for  achieving  an  auditable  SBR  by  the  alternative  deadline.  In  addition,  all 
material  amounts  reported  on  the  SBR  will  need  to  be  auditable  in  order 
to  achieve  the  mandated  goal  of  full  financial  statement  audit  readiness 
by  September  30,  2017. 


Army  General  Fund  SBR  The  Army  prepared  its  audit  readiness  strategy  to  provide  a  high-level 
Audit  Readiness  Strategy  overview  for  Army  leaders  and  stakeholders  to  understand  the  Army’s 

approach  for  achieving  audit  readiness  in  accordance  with  the  FIAR 
Guidance.17  In  connection  with  this  strategy,  the  Army’s  approach  for 
achieving  General  Fund  SBR  audit  readiness  includes  four  separate  FIPs 
developed  to  guide  improvement  efforts  in  the  following  areas:  (1)  budget 
execution,  (2)  military  pay,  (3)  financial  reporting,  and  (4)  FBWT.  The 
Army  also  relies  on  service  providers  to  ensure  the  audit  readiness  of 
service  provider  systems  and  business  processes  that  support  services 
provided  to  the  Army  and  affect  its  General  Fund  SBR.18  In  addition,  as 
shown  in  figure  1,  establishing  the  Army’s  audit-ready  systems 
environment  is  integral  to  the  Army’s  audit  readiness  strategy,  including 


17The  Army’s  audit  readiness  strategy  was  prepared  by  the  Office  of  the  Assistant 
Secretary  of  the  Army,  Financial  Management  and  Comptroller,  which  is  responsible  for 
managing  the  Army’s  audit  readiness  activities  with  appropriate  direction,  guidance,  and 
oversight. 

1  ft 

Reporting  entities  are  required  to  monitor  the  effectiveness  of  the  internal  control  over 
the  systems  and  services  provided  by  service  organizations  that  affect  classes  of 
transactions  significant  to  their  financial  statements. 
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implementation  of  the  General  Fund  Enterprise  Business  System 
(GFEBS)  and  other  key  enterprise  resource  planning  (ERP)  systems.19 


Figure  1:  Interrelated  Efforts  for  Achieving  Army  General  Fund  SBR  Audit  Readiness 


Budget  execution  consists  of:  funds  distribution,  contracts,  temporary  duty  travel,  miscellaneous  payments,  government  purchase  cards,  supply,  reimbursements, 
and  civilian  pay 


Source:  GAO  analysis  of  Army  data. 


19An  ERP  system  is  an  automated  system  using  commercial  off-the-shelf  software 
consisting  of  multiple,  integrated  functional  modules  that  perform  a  variety  of  business- 
related  tasks,  such  as  general  ledger  accounting,  payroll,  and  supply  chain  management. 
According  to  the  Army’s  fiscal  year  2013  audit  readiness  strategy,  auditability  depends  on 
an  audit-ready  systems  environment  and  the  successful  deployment  of  ERP  systems.  This 
includes  the  Logistics  Management  Program,  which  was  fully  deployed  in  October  2010; 
GFEBS,  which  was  fully  deployed  in  July  2012;  and  the  Global  Combat  Support  System- 
Army,  which  is  in  the  process  of  deployment  with  completion  expected  in  2017.  GFEBS  is 
a  web-enabled  accounting,  asset  management,  and  financial  reporting  system  and 
represents  the  Army’s  system  of  record  for  general  fund  financial  reporting.  Although  fully 
deployed,  GFEBS  is  not  fully  integrated  with  feeder  systems  such  as  military  pay,  whereby 
detail  transactions  are  summarized  into  GFEBS. 
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GFEBS  is  absorbing  more  than  100  legacy  accounting  and  other  systems 
to  standardize  business  processes  and  provide  more  accurate  data  on 
funds  availability  and  execution.  According  to  Army  sources,  GFEBS  is 
one  of  the  world’s  largest  ERP  systems,  supporting  approximately  1 
million  transactions  each  day  and  over  53,000  users  at  over  200  locations 
in  71  countries  in  fiscal  year  2013.  Also,  according  to  Army  sources, 
obligations  incurred  associated  with  contracts,  civilian  pay,  and  other 
business  activities  that  were  processed  in  GFEBS  represented  about  52 
percent  of  total  obligations  incurred  reported  in  the  Army’s  General  Fund 
SBR  for  fiscal  year  2013.  Based  on  efforts  to  record  military  pay 
expenditure  and  accounting  data  in  GFEBS  beginning  in  fiscal  year  2014, 
Army  officials  stated  that  GFEBS  is  expected  to  be  the  primary  system  for 
processing  Army  obligations  incurred  for  fiscal  year  2014. 

The  Army  reported  that  it  completed  Discovery  Phase  audit  readiness 
efforts  for  all  four  of  its  General  Fund  SBR  FIPs,  including  the  FIP  for 
budget  execution,  in  March  2013  and  expects  to  complete  the  Corrective 
Action  and  Assertion/Evaluation  Phases  by  June  2014  and  September 
2014,  respectively.  The  Army’s  FIP  for  budget  execution,  the  focus  of  this 
report,  is  particularly  important  as  it  addresses  improvement  efforts 
involving  significant  budgetary  resources  and  financial  activity  reported  in 
its  General  Fund  SBR  across  multiple  business  processes.  Further,  this 
FIP  focuses  on  the  development  of  GFEBS-based  audit-ready  processes, 
including  those  that  affect  obligations  incurred  reported  in  the  Army’s 
General  Fund  SBR,  and  emphasizes  incremental  “waves”  of  audit 
readiness  assertions  and  IPA  examinations  to  assess  progress  of  Army 
locations  and  business  processes  operating  in  the  GFEBS  environment. 
Originally,  the  Army  planned  four  waves,  but  in  fiscal  year  201 2  it 
compressed  its  assertions  to  three  waves  to  meet  the  DOD  time  frame 
and  NDAA  mandate  for  achieving  audit  readiness.  The  activity  and  timing 
of  these  waves  are  as  follows. 

•  Wave  1 .  In  June  201 1 ,  the  Army  asserted  audit  readiness  at  3  of  227 
locations  with  five  business  processes.20  An  IPA  completed  an 
examination  in  November  201 1  and  reported  that  the  Army  did  not 
effectively  design  test  plans  for  evaluating  the  operating  effectiveness 
of  key  controls  for  several  processes.  The  IPA  also  reported  that  the 


90 

The  Army’s  Wave  1  locations  included  the  Installation  Management  Command  (IMCOM) 
and  Training  and  Doctrine  Command  (TRADOC)  at  Fort  Benning  and  Fort  Jackson  and 
the  IMCOM  and  Forces  Command  (FORSCOM)  at  Fort  Stewart. 
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Army  did  not  (1)  properly  identify  all  key  control  objectives  and 
activities  and  risks  of  misstatement  related  to  its  processes  or 
consider  the  control  environment  as  a  whole  and  (2)  properly  identify 
the  financial  statement  risks  related  to  key  control  activities  and 
objectives  within  its  processes. 

•  Wave  2.  In  June  2012,  the  Army  asserted  audit  readiness  at  10  of  227 
locations  (3  Wave  1  locations  and  7  additional  locations)21  with  eight 
business  processes.  An  IPA  completed  an  examination  in  April  2013 
and  reported  several  inadequacies  in  the  Army’s  Wave  2  readiness 
assertion,  as  discussed  later  in  our  report. 

•  Wave  3.  In  June  2013,  the  Army  asserted  audit  readiness  for  eight 
GFEBS  processes  and  activities  at  remaining  locations.  An  IPA  is  to 
complete  an  examination  by  May  2014. 

•  Full  General  Fund  SBA.  The  Army  is  to  assert  audit  readiness  for  all 
current  year  activity  and  funding  by  June  2014. 


The  Army  Did  Not 
Fully  Follow  FIAR 
Guidance  in 
Determining  the 
Scope  of  Its  General 
Fund  Budget 
Execution  Audit 
Readiness  Efforts 


To  help  prioritize  and  guide  its  efforts,  the  Army  developed  its  FIP  for 
budget  execution  emphasizing  the  implementation  of  effective  GFEBS 
processes  for  achieving  SBR  audit  readiness.  However,  the  Army  did  not 
fully  complete  key  tasks  to  help  ensure  that  its  FIP  adequately  considered 
the  scope  of  efforts  required  to  achieve  audit  readiness  and  addressed 
significant  qualitative  risks  or  other  factors  affecting  its  efforts,  as  required 
by  FIAR  Guidance.  For  example,  the  Army’s  analysis  identifying  Army 
and  service  provider  business  processes  and  systems  supporting  its 
General  Fund  SBR  FIP  for  budget  execution  was  incomplete. 

In  accordance  with  the  March  2013  FIAR  Guidance,  the  Army  limited  the 
scope  of  its  efforts  to  focus  on  achieving  SBA  audit  readiness  by 
September  30,  2014.  Therefore,  the  Army  excluded  measures  to  ensure 
the  readiness  of  beginning  balances  associated  with  funding  received  in, 
and  carried  forward  from,  prior  years  and  activity  processed  in  certain 
legacy  systems.  While  achieving  SBA  audit  readiness  can  provide  a 
meaningful  indicator  of  progress,  the  amounts  excluded  are  material  to 
the  Army’s  SBR  and  may  continue  to  represent  material  portions  of  future 


21  In  addition  to  the  Army’s  Wave  1  locations,  Wave  2  locations  included  IMCOM  and 
FORSCOM  at  Fort  Bragg,  Fort  Campbell,  Fort  Drum,  and  Fort  Polk;  IMCOM  and 
TRADOC  at  Fort  Gordon  and  Fort  Rucker;  and  IMCOM  at  Fort  Knox. 
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SBRs.  Further,  the  Army  had  not  performed  an  assessment  to  adequately 
demonstrate  the  expected  magnitude  of  these  amounts  in  future  years 
and  address  risks  associated  with  them  as  required.  As  a  result,  the  Army 
lacks  important  assurance  that  it  will  achieve  audit  readiness  goals  as 
planned.  Also,  the  Army  did  not  address  whether  it  will  meet  the 
September  30,  2014,  deadline  for  an  auditable  SBR  in  its  determination  of 
audit  readiness  included  in  DOD’s  November  2013  FIAR  Plan  Status 
Report  and  did  not  clearly  indicate  an  alternative  date  for  achieving  full 
SBR  audit  readiness,  as  required  by  the  NDAA  for  Fiscal  Year  2013. 


The  Army’s  Identification 
of  Significant  SBR 
Amounts  and  Processes 
Was  Incomplete 


Per  the  FIAR  Guidance,  Discovery  Phase  Task  1  (statement  to  process 
analysis)  requires  reporting  entities  to  identify  the  assessable  units, 
business  processes,  systems,  and  other  characteristics  associated  with 
amounts  reported  in  each  financial  statement  line  item.  Also,  because  of 
the  significant  reliance  placed  on  service  providers,  the  FIAR  Guidance 
also  requires  reporting  entities  to  (1)  coordinate  with  them  to  ensure  that 
the  statement  to  process  analysis  identifies  significant  assessable  units 
associated  with  service  provider  processes  and  systems  supporting  each 
line  item  and  (2)  formalize  and  document  their  relationship  with  the 
service  providers  in  a  memorandum  of  understanding  (MOU).22 
Completing  these  tasks  is  essential  for  understanding  the  relative 
importance  and  multifaceted  nature  of  audit  readiness  efforts  and  for 
developing  an  effective  strategy.  However,  we  found  that  the  Army  had 
not  effectively  completed  these  tasks  as  discussed  below. 


•  Statement  to  process  analysis.  For  this  task,  the  Army  prepared  a 
General  Fund  SBR  statement  to  process  analysis  supporting  its  FIP 
for  budget  execution  Wave  2  readiness  assertion,  which  identified  the 
portions  of  obligations-incurred  activity  processed  in  GFEBS  that  were 
attributable  to  key  assessable  units,  such  as  civilian  pay,  contracts, 
and  supplies.  However,  this  analysis  did  not  show  the  linkage  of  key 


22According  to  the  FIAR  Guidance,  in  addition  to  coordinating  with  service  providers  to 
perform  statement  to  process  analyses  and  prioritize  audit  readiness  efforts,  reporting 
entities’  consideration  of  service  providers’  activities  and  how  they  affect  the  entities’ 
financial  processes  should  be  embedded  within  the  various  phases  of  audit  readiness 
efforts.  Also,  service  providers  are  to  prepare  documentation  illustrating  the  financial 
reporting  aspects  of  their  operations  through  end-to-end  business  processes  and  identify 
and  evaluate  control  activities  and  supporting  documentation  over  those  processes  that 
affect  the  reporting  entities’  financial  reporting  objectives  (i.e.,  the  outcomes  needed  to 
achieve  proper  financial  reporting  and  serve  as  a  point  against  which  the  effectiveness  of 
financial  controls  can  be  evaluated). 
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SBR  financial  statement  line  items  to  all  significant  assessable  units 
and  therefore  was  incomplete.  Specifically,  the  Army’s  analysis 
focused  only  on  obligations-incurred  activity  processed  in  GFEBS, 
which,  as  of  September  30,  2013,  represented  about  52  percent,  or 
$119  billion,  of  total  reported  General  Fund  obligations,  as  shown  in 
figure  2. 


Figure  2:  Army  General  Fund  Obligations  Incurred  in  GFEBS,  Fiscal  Year  2013 


Army  FY13  General 
Fund  Statement  of 
Budgetary  Resources3 

(Circles  not  to  scale) 


Unobligated  funds 

$39  billion 


Total  budgetary 
resources 

$267  billion 


Obligations 
incurred  in 
other  systems 

$109  billion 

48%  N 


Obligations 
incurred  in 
GFEBS 
$119  billion13 
/, 


^52% 


Obligations 

incurred 

$228  billion 


Source:  GAO  analysis  of  Army  data. 

aThis  consists  of  budgetary  resources,  the  status  of  those  resources,  the  change  in  obligated 
balances,  and  gross  to  net  budget  authority  and  outlays. 

bThe  Army's  FIP  for  budget  execution  focused  audit  readiness  efforts  on  obligations  incurred  in 
GFEBS. 

Assessable  units  and  related  amounts  associated  with  remaining 
obligations  incurred  activity  processed  in  non-GFEBS  systems, 
totaling  $109  billion  for  fiscal  year  2013,  were  not  included  in  the 
Army’s  analysis.  Further,  other  SBR  activity  attributable  to  service 
provider  business  processes  and  systems  was  also  excluded. 
According  to  Army  officials,  they  excluded  these  amounts  because  of 
the  Army’s  expectation  that  (1)  service  providers  will  ensure  the 
readiness  of  their  systems  and  processes  and  (2)  the  Army’s  reliance 
on  certain  legacy  systems  will  decline  significantly  in  connection  with 
its  further  implementation  of  GFEBS.  In  addition,  unobligated  and 
unpaid  obligated  amounts  carried  forward  from  prior  years — or 
beginning  balances — were  excluded  from  its  analysis,  which, 
according  to  Army  officials,  was  consistent  with  the  March  2013  FIAR 
Guidance  revision  to  narrow  the  focus  of  initial  audits  to  SBAs. 
Further,  Army  officials  indicated  that  devoting  significant  resources  to 
ensure  the  readiness  of  these  legacy  systems  and  beginning 
balances  was  not  cost  effective,  and  accordingly,  they  excluded 
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efforts  to  ensure  their  auditability  from  the  scope  of  the  Army’s 
readiness  strategy. 

The  Army’s  consideration  of  the  cost-effectiveness  of  its  readiness 
efforts  is  important.  However,  its  exclusion  of  these  amounts  and 
processes  did  not  eliminate  the  FIAR  Guidance  requirements  to 
identify  all  assessable  units  with  processes  that  result  in  transactions 
and  balances — including  beginning  balances — material  to  the  SBR 
and  to  consider  the  risks  associated  with  them  in  developing  its  audit 
readiness  strategy.  In  addition,  documentation  provided  by  FIAR 
Directorate  officials  supporting  the  rationale  for  revising  the  FIAR 
Guidance  concerning  beginning  balances  specifies  that  the  revision 
was  not  intended  to  affect  Discovery  Phase  requirements.  Further,  the 
FIAR  Guidance  also  requires  reporting  entities  to  identify  processes 
and  systems  supporting  existing  “as-is”  environments,  in  addition  to 
planned  “to-be”  environments  associated  with  implementing  new 
financial  systems.  This  requirement  also  recognizes  the  complexities 
and  challenges  associated  with  implementing  large-scale  financial 
systems,  such  as  GFEBS,  and  the  importance  of  identifying  and 
addressing  risks  associated  with  legacy  systems  and  related  business 
processes.  Addressing  such  risks  is  to  be  performed  during  Discovery 
Phase  Task  2  and  is  essential  for  developing  a  cost-effective 
readiness  strategy. 

•  Service  provider  assessable  units  and  MOU.  The  Army’s  analysis 
did  not  identify  activity  attributable  to  assessable  units  associated  with 
service  provider  business  processes  and  systems,  as  required  by  the 
FIAR  Guidance,  despite  the  significant  impact  they  have  on  the 
Army’s  SBR  and  its  reliance  on  them  to  help  achieve  readiness.  Also, 
the  Army  had  not  established  an  MOU  with  its  service  providers  to 
formally  document  a  shared  understanding  of  roles  and 
responsibilities  affecting  audit  readiness  efforts  as  required  by  the 
FIAR  Guidance.  For  example,  an  MOU  would  include  roles  and 
responsibilities  for  the  authorization,  initiation,  processing,  recording, 
and  reporting  of  transactions  affected  by  the  service  provider, 
including  requirements  for  the  retention  of  supporting  documents. 
Army  officials  stated  they  had  established  a  Mission  Work  Agreement 
with  DFAS,  a  document  that  defines  the  terms  of  work,  describing 
various  types  of  services  DFAS  provides  to  the  Army,  including  those 
associated  with  financial  reporting,  civilian  and  military  pay,  contract 
pay,  and  other  processes.  However,  it  does  not  contain  the  level  of 
detail  needed  in  an  MOU  to  help  ensure  coordination,  performance, 
and  accountability  of  the  parties,  such  as  a  clear  linkage  between  the 
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services  described  and  specific  control  activities  DFAS  is  required  to 
perform  that  affect  the  Army’s  financial  reporting  objectives.  According 
to  Army  officials,  efforts  to  coordinate  with  service  providers  to  obtain 
sufficient  information  on  their  business  processes  and  systems  and 
establish  MOUs  has  been  challenging  as  relationships  and  audit 
readiness  interdependencies  with  the  service  providers  are  very 
complex.  They  also  indicated  that  the  FIAR  Directorate  has  been 
taking  a  lead  role  in  coordinating  efforts  of  service  providers  to  help 
facilitate  the  development  of  MOUs  but  that  time  frames  for  finalizing 
them  had  not  been  determined.  Until  the  relationships  between  the 
Army  and  its  service  providers  are  identified  and  documented  in 
sufficient  detail,  the  Army  remains  at  risk  of  important  tasks  necessary 
to  ensure  audit  readiness  not  being  identified  or  completed  as 
intended. 


The  Army’s  Assessment  of 
Key  Risks  Is  Not 
Documented 


Per  the  FIAR  Guidance,  Task  2  of  the  Discovery  Phase  (prioritizing 
readiness  efforts)  requires  reporting  entities  to  rank  all  assessable  units 
based  on  materiality  and  to  identify  and  document  qualitative  risks  and 
other  factors  associated  with  each  of  those  identified.  Also,  this  task 
requires  reporting  entities  to  identify  and  document  entity-level  controls, 
including  assessments  of  internal  and  external  risks  that  may  affect  their 
readiness  efforts  and  serve  as  the  basis  for  their  FIPs.23  The  Army 
developed  its  FIP  for  budget  execution  to  help  guide  its  General  Fund 
SBR  audit  readiness  activities  and  focus  efforts  on  implementing  GFEBS- 
based  audit-ready  processes.  However,  for  this  task,  we  found  that  the 
Army  did  not  identify  and  document  its  consideration  of  several  significant 
qualitative  risks  and  other  factors  in  developing  its  General  Fund  FIP  for 
budget  execution.  Documentation  demonstrating  the  Army’s  identification 
and  evaluation  of  these  risks  is  essential  to  help  ensure  that  incremental 
SBA  and  full  SBR  audit  readiness  goals  will  be  achieved.  Additional 
details  concerning  these  risks  are  highlighted  below. 


Reliance  on  service  providers.  The  Army  relies  heavily  on  service 
providers,  such  as  DFAS,  to  process  accounting  and  payment 
transactions  as  well  as  ensure  the  effectiveness  of  the  controls  and 
information  systems  they  use  in  providing  support  to  the  Army. 


po 

According  to  the  FIAR  Guidance,  entity-level  controls  refer  to  control  environment,  risk 
assessment,  control  activities,  information  and  communication,  and  monitoring  as 
described  in  GAO,  Standards  for  Internal  Control  in  the  Federal  Government,  GAO/AIMD- 
00-21.3.1  (Washington,  D.C.:  November  1999). 
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Accordingly,  the  FIAR  Guidance  requires  service  providers  to  ensure  the 
readiness  of  their  systems  and  business  processes  that  have  a  material 
impact  on  reporting  entity  SBRs.  However,  as  previously  discussed,  the 
Army’s  efforts  to  better  understand  and  document  complex  relationships 
and  audit  readiness  interdependencies  with  service  providers  have  not 
been  completed,  hampering  its  ability  to  obtain  sufficient  information 
concerning  risks  associated  with  their  activities.  Further,  the  Army’s  ability 
to  rely  on  service  providers  remains  unclear  since,  as  discussed  later  in 
this  report,  IPA  or  DOD  OIG  assessments  of  the  audit  readiness  of 
service  provider  systems  and  processes  have  not  been  completed.  As  a 
result,  the  Army  is  at  increased  risk  that  it  may  not  meet  its  audit 
readiness  goals. 

Limitations  in  scope  of  audit  readiness  efforts.  As  previously 
discussed,  the  Army’s  strategy  did  not  include  efforts  to  ensure  the  audit 
readiness  of  (1)  SBR  beginning  balances  and  (2)  certain  legacy  systems 
and  business  processes  the  Army  relies  on  to  support  significant  portions 
of  its  SBR.  Risks  associated  with  these  scope  limitations,  if  not  properly 
addressed,  could  adversely  affect  the  Army’s  ability  to  achieve  audit 
readiness  goals  as  highlighted  below. 

•  Beginning  balances.  The  Army  reported  beginning  balances  (as  of 
October  1 ,  201 2)  of  $44.3  billion  and  $1 38.7  billion  for  unobligated 
and  unpaid  obligated  balances,  respectively,  on  its  General  Fund  SBR 
for  fiscal  year  2013,  representing  amounts  associated  with  prior  year 
funding  brought  forward  from  fiscal  year  201 2. 24  While  the  FIAR 
Guidance  provides  for  limiting  the  focus  of  initial  audits  to  current  year 
budget  activity  and  expenditures  contained  in  SBAs,  it  does  not 
eliminate  the  requirement  to  identify  and  assess  risks  associated  with 
these  beginning  balances  for  achieving  full  SBR  auditability. 
Accordingly,  assessing  the  extent  to  which  amounts  associated  with 
prior  year  funding  may  affect  efforts  to  achieve  this  goal  is  essential. 
Also,  apart  from  the  FIAR  requirements,  the  Army  continues  to  be 
responsible  for  the  accuracy  of  reported  balances  relating  to  current 
and  prior  year  budget  activity  in  order  to  comply  with  appropriations 
law,  and  to  accurately  report  them  by  appropriation  for  inclusion  in  the 


24As  of  September  30,  2013,  the  Army  reported  unobligated  and  unpaid  balances  of 
$38.6  billion  and  $120.7  billion,  respectively,  on  its  General  Fund  SBR  for  fiscal  year  201 3. 
Accordingly,  these  amounts  will  be  reported  as  beginning  balances  on  its  General  Fund 
SBR  for  fiscal  year  2014. 
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President’s  annual  budget  request.25  Recognizing  the  need  to  ensure 
the  accuracy  of  information  contained  in  agency  budget  requests, 
agencies  are  also  required  to  include  information  in  their  audited 
financial  statements  showing  material  differences  between  key 
amounts  contained  in  their  SBRs  and  related  amounts  contained  in 
the  President’s  Budget.26  However,  the  Army’s  most  recent  financial 
statements  for  fiscal  years  2013  and  2012  remain  unaudited  and, 
importantly,  do  not  provide  information  regarding  material  differences, 
if  any,  between  comparable  amounts  reported  in  its  SBR  and  the 
President’s  Budget.  As  a  result,  the  extent  to  which  the  Army  can 
provide  needed  assurance  regarding  the  accuracy  of  reported 
balances  and  activity  related  to  prior  budget  years  contained  in  the 
President’s  Budget  is  limited. 

Despite  these  requirements,  Army  officials  told  us  that  the  Army  had 
not  identified  risks  associated  with  beginning  balances  reported  on  its 
SBR  or  assessed  how  and  when  efforts  to  prepare  auditable  SBAs 
would  result  in  full  SBR  audit  readiness.  Specifically,  at  the  time  of  our 
review,  the  Army  had  not  determined  how  achieving  audit  readiness 
would  be  affected  by  expenditures  or  other  activity  associated  with 
beginning  balances  that  are  expected  to  occur  in  future  years.  The 
Army  has  various  appropriated  funds  that  are  available  for  obligation 
for  1,2,3,  and  5  fiscal  years.  After  these  periods  of  availability  expire, 
the  accounts  remain  open  for  5  additional  fiscal  years  to  adjust  or 
liquidate  obligations  before  the  accounts  are  closed  and  any 
remaining  balances  are  canceled.  For  example,  the  fiscal  year  2012 
ending  balances  included  five  3-year  procurement  appropriation 
accounts  containing  $12.3  billion  that  had  not  been  obligated  for 
payment,  and  $39.2  billion  that  the  Army  had  obligated  to  pay  but  had 
not  yet  disbursed.  The  Army  will  potentially  be  required  to  account  for 
these  procurement  appropriations  into  fiscal  year  2019,  beyond  the 


25lf  the  Army  does  not  have  assurance  that  its  available  balances  are  accurate,  it  is  at  risk 
of  overobligating  or  overspending  its  budgetary  authority  in  violation  of  the  Antideficiency 
Act,  31  U.S.C.  §§  1341-42,  1349-52,  1511-19. 

26Statement  of  Federal  Financial  Accounting  Standards  No.  7,  Accounting  for  Revenue 
and  Other  Financing  Sources  and  Concepts  for  Reconciling  Budgetary  and  Financial 
Accounting,  requires  agencies  to  provide  a  schedule  in  the  notes  to  their  financial 
statements  displaying  material  differences  between  the  SBR  and  President’s  Budget.  At  a 
minimum,  material  differences  for  comparable  line  items  related  to  budgetary  resources, 
obligations,  distributed  offsetting  receipts,  and  outlays  should  be  displayed  accompanied 
by  explanations  of  the  differences. 
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current  audit  readiness  plan  as  well  as  the  September  30,  2017, 
deadline  for  achieving  auditability  of  its  full  SBR  and  other  financial 
statements  for  fiscal  year  2018.  Additional  analysis  documenting  and 
supporting  the  Army’s  expectations  concerning  the  extent  to  which 
future  SBRs  may  include  significant  activity  and  balances  associated 
with  these  multiyear  appropriation  funds  would  assist  in  assessing 
risks  that  could  impede  audit  readiness. 

•  Legacy  systems.  According  to  the  FIAR  Guidance,  reporting  entities 
involved  in  system  transformation  initiatives  are  required  to  assess  the 
target  dates  of  their  to-be  environments  against  their  audit-ready 
assertion  dates  to  determine  whether  existing  systems,  to-be 
systems,  or  both  should  be  included  in  their  current  readiness  efforts. 
In  this  regard,  based  on  transformation  efforts  associated  with 
implementing  GFEBS  and  other  key  ERP  systems  intended  to  replace 
certain  existing  legacy  systems,  the  Army  excluded  tasks  to  ensure 
the  readiness  of  these  legacy  systems  and  related  business 
processes  from  the  scope  of  its  readiness  efforts.  The  Army  expects 
the  appropriation  accounts  that  would  continue  to  generate 
transaction  data  from  such  systems  to  be  expended  or  expired  and 
thus  amounts  would  become  immaterial  overtime.  However,  officials 
told  us  that  they  were  uncertain  as  to  how  continued  reliance  on  these 
systems  may  affect  initial  audits.  For  example,  officials  told  us  that  a 
timeline  for  transitioning  funding  for  classified  and  other  associated 
activity  from  legacy  systems  to  a  GFEBS-based  environment  has  not 
been  determined.  Until  this  transition  occurs,  ongoing  activity 
accounted  for  in  legacy  systems  could  have  a  major  impact  on  the 
Army’s  SBAs  and  SBR.  Also,  processing  billions  of  dollars  in 
unobligated  balances  and  unpaid  obligations  in  the  Army’s  five 
procurement  appropriation  accounts  that  are  accounted  for  in  legacy 
systems  as  previously  discussed  could  take  several  years.  Therefore, 
this  ongoing  activity  will  likely  affect  initial  examinations  of  incremental 
SBAs  currently  expected  to  begin  with  fiscal  year  2015  as  well  as  full 
SBRs  to  be  examined  in  subsequent  years. 

Army  officials  acknowledged  these  risks  and  that  the  Army  had  not 
documented  its  assessment  of  them.  Despite  the  uncertainty  associated 
with  how  these  risks  may  affect  the  auditability  of  the  Army’s  incremental 
SBAs  and  full  SBRs,  according  to  Army  officials,  the  scope  of  their  efforts 
and  plans  for  adhering  to  established  audit  readiness  assertion  and 
examination  milestones  have  remained  unchanged.  However,  without 
sufficient  documentation  identifying  these  risks  and  assessing  their 
potential  impact  on  producing  auditable  SBAs  and  full  SBRs  within 
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established  time  frames,  the  Army  is  unable  to  provide  needed  assurance 
that  its  strategy  will  achieve  audit  readiness  or  when  it  will  be  achieved. 

Further,  as  discussed  earlier,  the  NDAA  for  Fiscal  Year  2013  requires  that 
DOD’s  FIAR  Plan  Status  Reports  include  the  Army’s  determination  on 
whether  it  will  achieve  an  auditable  SBR  by  September  30,  2014. 
Recognizing  the  potential  impact  of  audit  readiness  challenges,  the  NDAA 
also  requires  that  the  FIAR  Plan  Status  Report  include  an  alternative  date 
for  achieving  SBR  audit  readiness  if  the  Army  determines  that  it  is  unable 
to  meet  this  deadline.  However,  the  Army’s  determination,  as  presented 
in  the  November  2013  FIAR  Plan  Status  Report,  did  not  meet  these 
requirements.  Specifically,  while  the  Army’s  determination  stated  that  it 
would  achieve  SBA  audit  readiness  by  September  30,  2014,  it  did  not 
address  whether  full  SBR  auditability  would  be  achieved  by  that  date  or,  if 
not,  clearly  indicate  an  alternative  deadline  for  doing  so. 


The  Army  Did  Not 
Effectively  Implement 
Key  Tasks  in  Its 
Budget  Execution  FIP 
in  Accordance  with 
FIAR  Guidance 


For  those  budget  execution  audit  readiness  activities  the  Army 
determined  to  be  within  the  scope  of  its  FIP  for  budget  execution,  the 
Army  has  made  progress  toward  implementing  the  first  three  phases  of 
Discovery,  Corrective  Action,  and  Assertion/Evaluation.  For  example,  the 
Army  identified  selected  control  activities  and  conducted  monthly  tests  to 
assess  their  effectiveness,  developed  tools  to  assist  commands  in 
assessing  controls  and  remediating  deficiencies,  and  outlined  efforts  to 
address  IPA-reported  deficiencies  related  to  its  Wave  2  audit  readiness 
assertion.  However,  we  found  that  it  did  not  always  follow  the  FIAR 
Guidance  in  performing  tasks  required  for  these  phases.  For  example,  we 
found  that  the  Army’s  documentation  and  assessment  of  internal  controls 
were  not  always  complete  or  accurate  and  that  extensive  deficiencies  had 
not  been  remediated  prior  to  an  I  PA  firm’s  examination  of  its  audit 
readiness  efforts.  The  Army  plans  to  address  remaining  tasks  required  for 
the  Validation  and  Audit  Phases  after  June  2014. 


Discovery  Phase  Tasks 
Were  Not  Effectively 
Implemented 


As  a  result  of  the  Army’s  decision  to  limit  the  scope  of  its  FIP  for  budget 
execution,  remaining  Discovery  Phase  efforts  largely  focused  on 
establishing  an  audit-ready  GFEBS  environment.  In  connection  with  these 
efforts,  the  Army  prepared  narratives,  flowcharts,  and  risk  assessments 
documenting  manual  and  GFEBS  automated  control  activities  and 
financial  reporting  objectives  as  well  as  an  inventory  of  key  supporting 
documents  associated  with  various  SBR-related  business  processes.  The 
Army  also  prepared  a  reconciliation  of  GFEBS  activity  to  help  identify  the 
population  of  transactions  to  be  used  for  assessing  controls  and 
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summarized  its  evaluation  of  controls  in  its  annual  statement  of 
assurance  on  internal  controls  over  financial  reporting  and  financial 
systems.27 

However,  as  discussed  below,  based  on  our  review  of  efforts  as  the  Army 
was  completing  its  Discovery  Phase  activities  in  June  2013,  it  had  not 
completed  or  effectively  implemented  Discovery  Phase  Task  3  (document 
processes  and  assess/test  controls)  and  Task  4  (evaluate  supporting 
documentation)  as  required  by  the  FIAR  Guidance.  Without  effective 
implementation  of  the  Discovery  Phase  of  the  FIAR  Guidance  for  its 
budget  execution  FIP,  the  Army  is  at  increased  risk  that  problems  that 
could  hinder  audit  readiness  efforts  will  not  be  identified  and  controls  for 
ensuring  reliable  financial  reporting  will  not  be  effectively  tested, 
assessed,  or  documented.  Further,  without  adequate,  reliable  information 
on  the  effectiveness  of  controls,  including  those  at  the  command  level 
and  those  associated  with  its  information  technology  systems,  the  Army  is 
at  increased  risk  of  not  fully  addressing  deficiencies  that  may  significantly 
affect  its  ability  to  achieve  its  audit  readiness  goals. 

Documentation  of  Business 

Processes  and  Control 

Assessments  Was  Incomplete 


With  regard  to  Task  3  of  the  Discovery  Phase  on  documenting  processes 
and  related  control  assessments  and  testing,  we  found  the  following. 

•  Documentation  of  the  linkage  of  certain  financial  reporting  objectives 
to  related  control  activities  was  incomplete.28  The  FIAR  Guidance 
requires  reporting  entities  to  evaluate  control  activities  to  determine  if 
they  have  been  designed  to  meet  financial  reporting  objectives. 
However,  the  Army’s  listing  of  controls  used  to  demonstrate  this 
linkage  did  not  identify  controls  to  address  13  of  84  financial  reporting 
objectives,  which  could  lead  to  weaknesses  in  financial  reporting.  For 
example,  the  listing  did  not  identify  specific  control  activities  to  ensure 
that  obligations  relate  to  valid  appropriations  and  do  not  include  any 


27DOD  components  are  required  to  annually  submit  a  statement  attesting  to  the  level  of 
assurance  on  the  effectiveness  of  internal  controls  over  financial  reporting  and  financial 
systems  and  compliance  with  applicable  laws  and  regulations. 

no 

According  to  the  FIAR  Guidance,  financial  reporting  objectives  are  defined  as  the 
outcomes  needed  to  achieve  proper  financial  reporting  and  serve  as  a  point  against  which 
the  effectiveness  of  financial  controls  can  be  evaluated.  Control  activities  are  defined  as 
policies,  procedures,  and  mechanisms  in  place  to  help  ensure  that  objectives  are  met. 


Page  19 


GAO-14-60  DOD  Financial  Management 


expired,  canceled,  or  rescinded  amounts.29  Based  on  our  review  of 
the  missing  linkages  we  identified  and  discussions  with  officials,  the 
Army  did  not  sufficiently  monitor  the  preparation  of  the  listing  to 
ensure  its  completeness.  Effective  monitoring  controls  to  detect  or 
prevent  such  omissions  are  essential  as  the  lack  of  complete, 
accurate  information  on  the  control  activities  the  Army  relies  on  to 
achieve  its  financial  reporting  objectives  could  impede  future  efforts  to 
audit  its  financial  statements. 

•  Documentation  of  the  criteria  and  processes  used  for  identifying  key 
information  technology  systems  was  incomplete.  Specifically,  the 
FIAR  Guidance  required  the  Army  to  identify  key  systems  and  feeder 
systems  affecting  audit  readiness  assertions  and  to  consider  various 
types  of  systems,  such  as  general  ledger  systems,  source/feeder 
systems,  disbursing  systems,  reporting  systems,  and  property 
management  systems,  as  well  as  system  interfaces.  According  to 
documentation  provided  by  Army  officials,  the  Army  identified  16  of  66 
systems  as  key  systems  affecting  SBR  audit  readiness.  This  included 
GFEBS  and  other  systems  used  to  process  detailed  transactions  and 
provide  accounting  data  to  be  recorded  in  GFEBS,  such  as  the  Army’s 
key  military  pay  system.  Army  officials  told  us  that  its  determination 
that  a  system  was  key  was  based  on  the  number  and  value  of 
transactions  initiated  or  processed  by  the  system  and  by  other  factors, 
such  as  whether  the  system  would  be  replaced.  While  its 
assessments  were  discussed  in  various  meetings  with  FIAR 
Directorate  and  DFAS  officials,  the  Army  did  not  document  the 
specific  criteria  and  assessment  process  used  to  support  its 
determination.  Without  adequate  documentation  to  support  the 
identification  of  key  systems,  the  Army  could  not  provide  assurance 
that  all  key  systems  had  been  identified  and  that  they  were  included  in 
its  audit  readiness  efforts. 

•  According  to  the  FIAR  Guidance,  the  Army  is  required  to  assess  the 
effectiveness  of  its  internal  controls.  Further,  the  Army  has  determined 
that  individual  commands  are  responsible  for  the  implementation  of 
controls  within  their  command.  Therefore,  the  effectiveness  of  controls 


^Appropriations  available  for  a  specified  period  of  time  expire  at  the  end  of  that  period 
and  the  unexpended  portion  of  the  appropriation  can  be  carried  forward  fora  maximum  of 
5  years.  At  the  end  of  the  fifth  fiscal  year  after  availability  ends,  the  appropriation  account 
is  closed  and  any  remaining  balance  is  canceled.  Further,  appropriation  accounts  may  be 
closed  if  rescinded  by  law. 
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Army-wide  depends  largely  on  efforts  to  ensure  that  they  are 
operating  effectively  at  each  command.30  However,  Army  officials  told 
us  that  assessments  of  the  effectiveness  of  controls  at  specific 
commands  were  not  always  reliable.  The  results  of  assessments 
performed  by  commands  in  2012  using  a  checklist  indicated  that  64 
percent  of  controls  assessed  were  operating  effectively.31  However, 
Army  officials  stated  that  the  checklist  was  to  help  commands 
understand  their  roles  and  responsibilities,  and  acknowledged  that  the 
Army  could  not  rely  on  self-reporting  by  commands  as  a  useful 
measure  of  audit  readiness.  While  a  checklist  can  provide  guidance 
and  assist  in  identifying  weaknesses,  officials  at  the  commands  we 
visited  told  us  that  users  may  not  be  sufficiently  knowledgeable  to 
accurately  complete  it.  Also,  officials  at  all  three  commands  we  visited 
told  us  that  their  ability  to  review  and  assess  the  effectiveness  of 
controls  has  been  hampered  by  a  lack  of  funding  and  staffing.  For 
example,  an  official  in  the  organization  responsible  for  reviewing 
control  assessments  at  one  command  told  us  that  its  ability  to  perform 
this  function  was  limited  because  of  a  34  percent  vacancy  rate  in 
staffing.  In  addition,  this  official  told  us  that  internal  control 
assessments  prepared  at  the  specific  garrison  level  within  a  command 
were  not  always  reliable.32  Officials  attributed  this,  in  part,  to  those 
preparing  them  not  having  appropriate  skills  or  not  performing 
sufficient  testing  to  adequately  assess  whether  controls  were 
operating  effectively. 

Command  officials  also  explained  that  much  of  the  information  they 
have  on  control  assessments  relates  to  results  associated  with  the 
Army’s  centralized  testing  of  the  operating  effectiveness  of  manual 
controls.  In  connection  with  this  testing,  the  Army  established  a  failure 
rate  of  5  percent  or  less  as  its  goal  for  assessing  the  effectiveness  of 
controls.  Results  of  this  testing  on  the  number  of  commands  tested 
through  May  2013,  when  the  Army  was  completing  its  Discovery 


on 

An  Army  command  is  defined  as  an  Army  force,  designated  by  the  Secretary  of  the 
Army,  performing  multiple  required  functions  across  multiple  disciplines. 

31  In  2012,  the  Army  Accountability  and  Audit  Readiness  Directorate  created  the 
Commander’s  Checklist  to  assist  commands  in  identifying  specific  controls  and  required 
commands  to  verify  whether  they  were  in  place  and  operating  effectively. 

op 

Garrisons  assist  in  managing  certain  Army  installations  by  supporting  readiness  and 
mission  execution  and  providing  services  and  facilities  for  efficient  delivery  of  base 
support  services. 
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Phase  efforts,  indicated  failure  rates  that  averaged  56  percent,  as 
shown  in  figure  3. 33 


33ln  connection  with  its  centralized  internal  control  testing,  the  Army  evaluated  whether  the 
applicable  manual  control  activities  or  attribute(s)  associated  with  each  transaction 
selected  fortesting  were  operating  effectively  and  determined  an  overall  failure  rate  based 
on  monthly  test  results.  These  results  do  not  include  assessments  of  information 
technology  controls. 


Page  22 


GAO-14-60  DOD  Financial  Management 


Figure  3:  The  Army’s  Reported  SBR  Internal  Control  Test  Failure  Rates  for  Commands  Tested 


Failure  rate 

Percent 

100 

90 

80 


Commands  tested 


8 

8 

1 

0 

8 

4 

1 

19 

19 

23 

25 

26 

N/A 

•  •• 

•  •••• 

•  •• 

•  •••• 

• 

•  •• 

•  •••• 

•  ••• 

• 

•  ••• 

•  •••• 

•  •••• 

•  •••• 

•  ••• 

•  •••• 

•  •••• 

•  •••• 

•  •• 

•  •••• 

•  •••• 

•  •••• 

•  •••• 

•  •••• 

•  •••• 

•  •••• 

•  •••• 

•  •••• 

• 

•  •••• 

•  •••• 

•  •••• 

•  •••• 

•  •••• 

<z> 

s-.jy 


‘V 


^  'V 


$ 

.cr 

<Z> 


/ 


Source:  GAO  analysis  of  Army  Leadership  Briefs,  June  2012  through  May  2013. 


Notes:  Monthly  failure  rates  shown  above  are  reported  in  Leadership  Briefs  along  with  data  used  to 
calculate  them,  including  the  total  number  of  sample  items  tested  (i.e.,  specific  control  activities 
associated  with  selected  transactions)  and  number  of  sample  item  failures  (i.e.,  control  activities  not 
operating  effectively).  The  average  total  failure  rate,  calculated  by  GAO,  represents  the  total  number 
of  sample  item  failures  divided  by  sample  items  tested  across  all  months,  based  on  monthly  data 
reported  in  the  Leadership  Briefs.  While  Army  operates  through  23  commands,  the  number  of 
commands  tested  also  includes  headquarters,  and  other  direct  reporting  units. 


Army  officials  attributed  the  November  2012  drop  in  failure  rates  to  28 
percent,  in  part,  to  the  experience  gained  by  the  use  of  GFEBS  by  the 
four  commands  that  were  tested  that  month.  As  indicated  in  figure  3, 
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beginning  in  January  2013,  Army  greatly  expanded  its  testing  to 
include  all  remaining  installations  migrating  to  GFEBS.  With  the 
substantial  increase  in  new  users,  test  results  indicated  failure  rates 
for  January  and  February  201 3  of  46  percent  and  64  percent, 
respectively.  Also,  the  Army  found  that  all  the  controls  tested  for 
February  and  March  2013  (14  and  15  controls,  respectively)  were 
operating  ineffectively.  As  installations  become  more  experienced  with 
GFEBS,  the  Army  expects  the  failure  rate  to  decrease. 

However,  the  methodology  for  the  Army’s  centralized  testing  was 
designed  to  produce  reliable  results  Army-wide,  and  as  command 
officials  pointed  out,  it  was  not  designed  to  produce  reliable 
assessments  of  controls  at  the  specific  command  level.  Further,  these 
officials  highlighted  how  Army-wide  assessments  can  vary 
significantly  from  more  detailed  assessments  performed  at  the 
command  level.  For  example,  controls  tested  for  6  of  15  Army 
Reserve  Command  sample  items  associated  with  two  business 
processes  (i.e.,  temporary  duty  travel  and  supply)  were  found  to  be 
ineffective  during  the  Army’s  February  2013  centralized  testing 
process,  equating  to  a  40  percent  failure  rate.  Army  Reserve 
Command  conducted  its  own  tests  using  a  larger  sample  of  412  items 
across  eight  business  processes  that  resulted  in  a  much  higher  (77 
percent)  failure  rate.34  Command  officials  described  plans  for 
performing  additional  assessments  to  better  understand  the 
effectiveness  of  their  controls;  however,  they  acknowledged  that 
insufficient  information  on  the  effectiveness  of  controls  has  hampered 
their  ability  to  develop  and  execute  appropriate  corrective  actions  to 
address  control  deficiencies. 

•  The  FIAR  Guidance  requires  reporting  entities  to  document  their 
understanding  of  business  processes,  systems,  and  related  control 
activities  with  narratives,  flowcharts,  risk  assessments,  and  internal 
control  worksheets.  However,  documentation  describing  Army  SBR- 
related  processes  and  systems  was  incomplete.  The  documentation 
did  not  address  complete  end-to-end  processes,  including  those 


34The  Army  Reserve  Command’s  February  2013  testing  included  sample  items  from  the 
following  business  processes:  Army-wide,  contracts,  temporary  duty  travel,  permanent 
change  of  station  travel,  other  travel,  government  purchase  card,  supply,  and 
miscellaneous  payments.  While  the  same  SBR-related  control  activities  are  applicable 
across  all  commands,  the  specific  controls  tested  may  vary  depending  on  their 
applicability  to  the  transactions  selected  fortesting  at  specific  commands. 


Page  24 


GAO-14-60  DOD  Financial  Management 


related  to  legacy  systems  and  service  provider  activities  and  feeder 
systems,  thus  limiting  the  Army’s  ability  to  perform  complete  control 
assessments.35  Service  providers  are  responsible  for  the  systems 
they  operate  and  processes  they  perform  on  behalf  of  reporting 
entities,  and  tasks  for  preparing  process  and  system  narratives  and 
assessing  controls  associated  with  four  service  providers  are  included 
in  the  Army’s  FIP  for  budget  execution.36  However,  we  found  that  the 
Army  had  not  completed  these  tasks  and,  as  a  result,  did  not  have 
sufficient  information  to  effectively  assess  how  service  provider- 
related  activities  may  affect  its  ability  to  achieve  SBR  audit  readiness. 
Army  officials  told  us  that  except  for  DFAS,  service  providers  had  not 
provided  sufficient  documentation  of  their  control  activities  as  required 
by  the  FIAR  Guidance.  Such  documentation  is  needed  for  a  clear 
understanding  of  how  the  Army’s  financial  reporting  objectives  may  be 
affected  by  service  provider  controls  and  documentation.  According  to 
the  FIAR  Guidance,  to  assess  and  provide  assurance  on  the 
effectiveness  of  their  controls,  service  providers  are  to  undergo 
annual  examinations  in  accordance  with  Statement  on  Standards  for 
Attestation  Engagements  (SSAE)  No.  16,  Reporting  on  Controls  at  a 
Service  Organization. 37 

Army  officials  told  us  that  they  are  participating  in  a  FIAR  Directorate 
working  group  established  to  direct  and  coordinate  service  provider- 
related  audit  readiness  efforts.  According  to  Army  officials,  this  group 
is  working  to  help  map  out  complete  end-to-end  business  processes 
involving  responsibilities  shared  by  service  providers  and  reporting 
entities.  In  addition,  Army  officials  told  us  that  the  group  is  working  to 
facilitate  and  monitor  service  provider  efforts  to  prepare  for  SSAE 
No.  16  examinations  to  be  conducted  by  I  PA  firms  to  provide  an 


35According  to  the  FIAR  Guidance,  DOD  end-to-end  processes  involve  actions  necessary 
to  plan,  formulate,  execute,  report,  or  perform  other  activities  associated  with  various 
business  functions,  including  (1)  budget-to-report,  (2)  hire-to-retire,  (3),  order-to-cash, 

(4)  procure-to-pay,  (5)  acquire-to-retire,  and  (6)  plan-to-stock.  Portions  of  these  business 
functions  (e.g.,  civilian  pay  and  military  pay)  may  focus  on  specific  aspects  of  an  end-to- 
end  process  (e.g.,  hire-to-retire). 

36The  Army’s  FIP  for  budget  execution  contained  tasks  associated  with  the  following 
service  providers:  DFAS,  Defense  Logistics  Agency,  Defense  Contract  Management 
Agency,  and  Defense  Information  Systems  Agency. 

37SSAE  No.  16  provides  standards  for  auditors  to  follow  for  reporting  on  controls  at 
organizations  that  provide  services  to  user  entities  when  those  controls  are  likely  to  be 
relevant  to  user  entities’  internal  control  over  financial  reporting. 
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Audit  Readiness  Progress 
Reports  Were  Not  Accurate 


independent  assessment  on  the  effectiveness  of  service  provider 
control  activities.  Because  of  the  Army’s  reliance  on  service  provider 
controls  to  achieve  its  General  Fund  SBR  financial  reporting 
objectives,  Army  officials  told  us  that  their  readiness  efforts  greatly 
depend  on  the  results  of  service  provider  SSAE  No.  16  examinations. 
According  to  the  November  2013  FIAR  Plan  Status  Report,  initial 
SSAE  No.  16  examinations  for  7  of  13  service  provider  assessable 
units  and  systems  are  scheduled  for  completion  from  April  2014 
through  September  2015.  The  adequacy  of  controls  associated  with 
units  and  systems  to  be  assessed  through  these  examinations — such 
as  those  focused  on  contract  pay  at  DFAS  and  the  Defense  Contract 
Management  Agency — will  affect  the  Army’s  SBR  audit  readiness 
goal.  Accordingly,  the  Army’s  efforts  to  obtain  the  results  of  service 
provider  SSAE  No.  16  examinations  and  assess  them  to  determine  the 
adequacy  of  controls  supporting  complete  end-to-end  business 
processes  will  be  essential. 

With  regard  to  Task  4  of  the  Discovery  Phase  on  the  evaluation  of 
supporting  documentation,  the  status  of  audit  readiness  efforts  was  not 
accurately  reflected  in  the  Army’s  budget  execution  FIP  status  reports.38 
For  example,  some  activities  that  have  been  ongoing  since  2010  were,  as 
of  May  31,  2013,  reported  in  the  Army’s  FIP  status  report  at  zero  percent 
complete  although  they  were  expected  to  be  100  percent  complete  in 
April  2013.  An  Army  official  acknowledged  that  there  were  several  tasks 
on  the  FIP  status  report  that  were  erroneously  reported  as  zero  percent 
completed  that  in  fact  had  been  completed. 

Further,  according  to  DOD’s  May  2013  FIAR  Plan  Status  Report,  the 
Army’s  SBR  Discovery  Phase  efforts  were  completed  as  of  March  2013. 
However,  this  report  was  in  conflict  with  the  most  recent  FIP  status  report 
at  the  time.  The  March  2013  status  report  indicated  that  62  percent  of 
Discovery  Phase  tasks  were  completed,  with  many  tasks  not  expected  to 
be  completed  until  after  March  2013.  Also,  Army  officials  told  us  that  they 
had  limited  time  to  update  FIP  status  reports  because  of  efforts  focused 
on  preparing  for  the  Wave  3  assertion  in  June  2013  and  because 
OUSD(C)  did  not  require  updated  reports  during  the  90-day  period 
leading  up  to  readiness  assertions.  According  to  Standards  for  Internal 


OQ 

According  to  the  FIAR  Guidance,  reporting  entities  and  service  providers  are  required  to 
use  a  standard  template  for  reporting  information  to  improve  their  ability  to  manage  their 
FIPs  and  DOD’s  ability  to  monitor  progress  indicators,  such  as  task  start  and  finish  dates, 
percentage  complete,  and  persons  responsible  for  their  completion. 


Page  26 


GAO-14-60  DOD  Financial  Management 


Control  in  the  Federal  Government,  entities  must  have  relevant,  reliable, 
and  timely  communications  to  run  and  control  their  operations  and 
determine  whether  performance  plans  and  accountability  goals  are  being 
met.39  The  lack  of  accurate  and  consistent  information  on  progress  and 
plans  for  completing  remaining  audit  readiness  tasks  limits  the  ability  to 
effectively  manage  risks  and  assess  performance. 


Corrective  Action  Phase 
Tasks  Were  Not  Effectively 
Implemented 


While  some  progress  had  been  made  on  the  Army’s  SBR  FIP  for  budget 
execution  tasks  we  reviewed  through  May  2013  when  it  was  preparing  its 
readiness  assertion  for  Wave  3  GFEBS  processes  and  locations,  it  was 
still  in  the  process  of  completing  its  corrective  action  efforts.  However,  for 
actions  taken  through  this  date,  we  found  that  the  Army’s  efforts  did  not 
effectively  address  the  FIAR  Guidance  requirements  for  the  Corrective 
Action  Phase  tasks  for  the  budget  execution  FIP  of  identifying  appropriate 
corrective  actions,  validating  their  effectiveness,  and  adequately  tracking 
progress.  As  a  result,  the  Army  is  at  increased  risk  that  problems 
identified  during  the  Discovery  Phase  may  not  be  addressed  and  may 
therefore  hinder  its  ability  to  ensure  that  audit  readiness  goals  are 
effectively  achieved. 


As  defined  in  the  FIAR  Guidance,  the  Corrective  Action  Phase  comprises 
five  tasks:  (1)  design  of  the  audit-ready  environment,  to  include 
requirements  for  remediating  deficiencies  in  internal  controls  and 
supporting  documentation;  (2)  development  of  corrective  actions,  to 
include  concrete  corrective  action  plans  (CAP)  to  resolve  each  deficiency 
identified  during  the  Discovery  Phase;  (3)  development  of  resource 
requirements,  to  include  budget  estimates  of  funding  and  staffing  to 
execute  the  CAPs;  (4)  execution  of  the  CAPs,  to  include  performing 
procedures  to  verify  that  the  CAPs  have  successfully  remediated  the 
deficiencies;  and  (5)  notification  to  the  FIAR  Directorate  that  the  reporting 
entity  is  ready  for  an  examination  of  its  assessable  unit.40  The  Army  has 
taken  steps  toward  completing  these  tasks,  such  as  developing  The  SBR 
Audit  Support  Handbook — a  reference  tool  to  assist  commands  in 
implementing  GFEBS-based  processes  and  remediating  deficiencies — 
and  estimates  of  resources  required  to  execute  CAPs  and  conduct  other 
audit  readiness  activities.  However,  as  discussed  below,  we  found  that 


39GAO/AIMD-00-21 .3.1 . 

40 According  to  the  Army,  its  audit-ready  environment  focuses  on  the  implementation  of 
effective  GFEBS-based  processes. 
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Effectiveness  of  Efforts  to 
Develop  and  Execute 
Corrective  Actions  Unclear 


the  Army’s  efforts  to  develop  and  execute  corrective  actions  (Corrective 
Action  Phase  Tasks  2  and  4)  did  not  provide  adequate  assurance  that 
deficiencies  identified  during  the  Discovery  Phase  will  be  resolved  as 
required  by  the  FIAR  Guidance. 

According  to  its  FIP  status  report,  the  Army  began  efforts  to  develop  and 
execute  corrective  actions  in  March  2011  and  June  2011,  respectively,  to 
address  deficiencies  identified  during  the  Discovery  Phase.  Army  officials 
explained  that  the  primary  components  of  the  Army’s  corrective  action 
strategy  are  to  provide  targeted  feedback  to  commands  on  control  failures 
identified  through  monthly  testing;  perform  targeted  follow-up  visits  at 
commands  to  address  specific  challenges;  and  provide  training,  guides, 
and  other  tools  to  support  corrective  action  within  commands.  However, 
for  the  Corrective  Action  Phase,  the  Army  was  unable  to  clearly 
demonstrate  the  extent  to  which  (1)  CAPs  had  been  developed  containing 
specific  actions  to  resolve  each  identified  deficiency  (Task  2)  and 
(2)  required  actions  had  been  completed  and  deficiencies  had  been 
resolved  (Task  4).  These  limitations  resulted  from  a  corrective  action 
strategy  and  related  oversight  activities  that  were  not  designed  to  provide 
sufficient  detail  on  corrective  action  efforts  and  to  ensure  their 
effectiveness.  Additional  information  on  these  limitations  is  discussed 
below. 

•  Extent  to  which  CAPs  were  developed  to  resolve  identified 
deficiencies  unclear.  The  effectiveness  of  the  Army’s  corrective 
actions  depends  on  its  efforts  to  ensure  the  completeness  and 
effectiveness  of  CAPs  containing  specific  actions  planned  to  resolve 
identified  deficiencies  and  their  underlying  causes.  Recognizing  the 
need  to  ensure  the  completeness  of  corrective  actions  and  provide  a 
means  for  tracking  their  status,  the  FIAR  Guidance  requires  reporting 
entities  to  include  corrective  actions  to  resolve  each  deficiency 
identified  in  the  corrective  action  sections  of  their  FIP  status  reports. 
However,  actions  listed  in  the  Army’s  report  were  not  linked  to  specific 
CAPs  developed  to  address  identified  deficiencies,  and  as  a  result, 
the  Army’s  ability  to  demonstrate  the  completeness  of  its  corrective 
actions  was  limited.  Rather  than  listing  specific  tasks  or  references  to 
specific  CAPs,  actions  listed  on  the  Army’s  report  largely  consisted  of 
references  to  specific  control  activities  that  were  not  effectively 
implemented  based  on  the  results  of  monthly  control  testing.  Further, 
in  many  instances  these  references  were  outdated,  as  they  cited 
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controls  in  existence  prior  to  the  Army’s  realignment  of  controls  in 
February  2013. 41  Additionally,  we  found  that  the  Army’s  FIP  status 
report  did  not  include  corrective  actions  for  addressing  other  known 
deficiencies  and  assessing  the  severity  of  each  as  a  deficiency,  a 
significant  deficiency,  or  a  material  weakness,  as  required  by  the 
FIAR  Guidance.42  For  example,  we  found  that  the  Army’s  FIP  status 
reports  did  not  indicate  the  severity  or  include  actions  to  correct 
deficiencies  associated  with  (1)  service  provider  controls  and 
systems,  (2)  GFEBS  system  issues,  and  (3)  the  lack  of  supporting 
documentation  identified  through  substantive  testing.43 

In  addition,  the  effectiveness  of  the  Army’s  corrective  actions  for 
resolving  deficiencies  largely  depends  on  the  effectiveness  of  its 
discovery  efforts.  However,  as  previously  discussed,  the  Army  had  not 
effectively  implemented  Discovery  Phase  tasks,  including  efforts  to 
document  processes  and  assess  controls.  Consequently,  its  ability  to 
ensure  the  effectiveness  of  corrective  actions  was  limited.  Further,  we 
found  that  CAPs  at  the  command  level  were  not  always  effective.  For 
example,  at  one  of  the  commands  we  visited,  corrective  actions 
contained  in  the  commander’s  checklist  were  not  specific  enough  to 
address  the  extensive  weaknesses  reported.  Command  officials 
explained  that  this  occurred,  in  part,  because  sufficient  efforts  to 
assess  controls  had  not  been  completed  to  effectively  determine  the 
causes  of  identified  deficiencies,  thus  limiting  their  ability  to  develop 
effective  corrective  actions  to  remediate  the  deficiencies.  In  addition, 
command  officials  told  us  that  other  issues  hampering  their  discovery 
efforts  also  adversely  affected  their  ability  to  effectively  develop  and 


41 

According  to  Army  officials,  the  Army  realigned  controls  in  February  2013  by 
consolidating  similar,  but  more  specific,  control  activities  used  in  various  business 
processes  into  fewer,  broader  control  activities  applicable  to  multiple  processes. 

42A  material  weakness  is  a  deficiency,  or  combination  of  deficiencies,  in  internal  control 
over  financial  reporting  such  that  there  is  a  reasonable  possibility  that  a  material 
misstatement  of  the  entity’s  financial  statements  will  not  be  prevented,  or  detected  and 
corrected,  on  a  timely  basis.  A  deficiency  in  internal  control  exists  when  the  design  or 
operation  of  a  control  does  not  allow  management  or  employees,  in  the  normal  course  of 
performing  their  assigned  functions,  to  prevent,  or  detect  and  correct,  misstatements  on  a 
timely  basis.  A  significant  deficiency  is  a  deficiency,  or  a  combination  of  deficiencies,  in 
internal  control  that  is  less  severe  than  a  material  weakness,  yet  important  enough  to 
merit  the  attention  of  those  charged  with  governance. 

43According  to  the  May  and  November  201 3  FIAR  Plan  Status  Reports,  service  providers 
identified  various  deficiencies  associated  with  their  controls  and  systems  and  mentioned 
corrective  actions  to  address  them. 
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execute  corrective  actions.  These  issues  included  the  lack  of  sufficient 
resources  and  personnel  with  appropriate  skills. 

Also,  identifying  the  underlying  causes  of  identified  deficiencies  is 
essential  for  developing  specific  tasks  to  remediate  them.  As  part  of 
its  centralized  monthly  testing,  the  Army  identified  the  reasons  for 
each  sample-item  failure  and  communicated  them  to  affected 
commands.  In  Leadership  Briefs  summarizing  test  results,  the  primary 
reason  provided  for  these  failures  was  documents  not  being  signed 
and  dated  as  evidence  of  review.  However,  other  reasons  contributed 
to  sample-item  failures  but  the  Army  had  not  analyzed  them  to  better 
understand  their  relative  significance  and  assist  in  identifying 
underlying  causes.  Accordingly,  we  analyzed  the  reasons  for  the 
failures  for  January  201 3  through  March  201 3  by  grouping  them  into 
four  categories  based  upon  data  provided  at  the  time  of  our  review  in 
May  201 3.44  (See  fig.  4.) 


Figure  4:  Reasons  for  Internal  Controls  Deficiencies:  Results  of  Army  Testing, 
January  2013  through  March  2013 
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Source:  GAO  analysis  of  Army  testing  results. 


44ln  connection  with  its  monthly  testing,  the  Army  identified  the  reason  for  each  sample- 
item  control  failure  and,  in  selected  instances,  attributed  the  failure  to  more  than  one 
reason.  GAO’s  analysis  is  based  on  all  reasons  identified  by  the  Army  for  the  sample-item 
failures  supporting  its  monthly  failure  rates  for  January  2013  through  March  2013  (as 
shown  in  fig.  3). 
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Our  analysis  showed  that  over  half  of  the  failures  identified  were  due 
to  supporting  evidence  not  being  provided.  This  category  also 
included  samples  for  which  a  command  had  not  provided  a  response 
to  requests  for  documentation  within  required  time  frames.45  Officials 
at  the  three  selected  commands  we  visited  told  us  that  providing  the 
supporting  documentation  within  15  days  as  required  by  the  Army’s 
monthly  testing  schedule  was  often  difficult  because  they  needed  to 
coordinate  with  other  entities  to  obtain  the  documentation.  Also,  Army 
officials  stated  that  they  have  been  analyzing  the  nonresponses  to 
better  understand  why  they  occurred  and  attributed  them,  in  part,  to 
the  need  to  more  timely  obtain  documentation  from  third-party 
stakeholders,  such  as  DFAS.  They  also  acknowledged  that  some 
deficiencies  extended  across  commands  and,  in  some  instances, 
were  outside  the  control  of  individual  commands.  For  example, 
command  officials  told  us  that  their  test  failures  sometimes  resulted 
from  following  the  Army’s  guidance  for  executing  business  process 
activities  that  had  not  been  updated  to  reflect  changes  in  procedures 
resulting  from  previously  implemented  systems  changes.  However, 
the  ability  to  assess  the  extent  to  which  the  Army’s  corrective  actions 
are  targeted  at  addressing  the  underlying  causes  contributing  to 
sample-item  failures  is  limited  as  corrective  actions  to  address 
identified  deficiencies  were  not  linked  to  specific  tasks  or  references 
to  specific  CAPs. 

•  Extent  to  which  required  actions  were  completed  and  effective 
unclear.  Recognizing  the  need  for  information  to  measure  efforts  to 
execute  corrective  actions,  the  FIAR  Guidance  requires  reporting 
entities  to  (1)  verify  that  CAPs  have  been  effectively  implemented  and 
have  remediated  identified  deficiencies  and  (2)  update  FIP  status 
reports  to  reflect  corrective  action  progress  each  month.  These 
updates  are  to  include  any  scope  and  timeline  changes  resulting  from 
their  efforts.  However,  we  found  that  the  Army  was  unable  to 
effectively  demonstrate  its  verification  that  CAPs  had  been  effectively 
implemented.  This  occurred  because  corrective  actions  listed  in  its 
FIP  status  report  were  not  linked  to  CAPs  containing  specific  tasks 
and  time  frames  for  their  completion  to  remediate  deficiencies.  Army 
officials  explained  that  the  Army  was  relying  on  the  results  of  its 


45Prior  to  June  2013,  commands  were  required  to  provide  supporting  documentation 
associated  with  sample  test  items  within  1 5  days  of  their  being  requested.  In  May  2013, 
the  time  frame  for  providing  documentation  was  revised  to  5  days  beginning  in  June  2013. 
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centralized  monthly  control  testing  as  its  primary  means  to  monitor  the 
effectiveness  of  corrective  actions.  These  results  indicated  failure 
rates  of  56  percent  on  average,  raising  questions  concerning  the 
effectiveness  of  the  Army’s  corrective  actions.  Further,  while  such 
results  may  be  a  useful  indicator  of  progress,  they  do  not  identify  the 
root  causes  for  testing  failures  or  provide  needed  assurance  that 
deficiencies  have  been  resolved.  Verification  that  tasks  have  been 
completed  and  have  effectively  remediated  deficiencies  would  enable 
the  Army  to  better  demonstrate  that  it  has  sufficient  assurance 
concerning  the  effectiveness  of  its  efforts. 

In  addition,  the  Army’s  progress  toward  completing  corrective  actions 
as  reported  in  its  FIP  status  reports  was  not  accurate  and  the 
reliability  of  its  estimates  for  completing  them  was  unclear. 

Specifically,  Army  status  reports  indicated  the  status  of  many 
corrective  action  tasks  as  zero  percent  complete.  According  to  Army 
officials,  this  status  was  based  largely  on  results  associated  with  its 
monthly  control  testing.  They  also  explained  that  although  the  Army 
has  been  working  on  corrective  actions  since  2011,  it  had  difficulties 
in  estimating  interim  percentages  to  accurately  reflect  the  extent  of 
progress  achieved.  In  addition,  Army  FIP  status  reports  indicated  that 
corrective  actions  would  be  completed  by  March  2014.  This  estimate, 
according  to  Army  officials,  was  based  largely  on  dates  previously 
established  to  meet  audit  readiness  assertions.  However,  since  the 
Army’s  reported  progress  and  estimates  for  completing  corrective 
actions  are  not  linked  to  CAPs  containing  specific  actions  already 
taken  and  time  frames  for  completing  those  still  remaining  to 
remediate  deficiencies,  their  accuracy  and  reliability  remain  unclear. 

According  to  its  corrective  action  strategy,  the  Army  placed  responsibility 
on  commands  to  resolve  identified  deficiencies.  However,  the  limitations 
we  identified  resulted  from  insufficient  oversight  steps  to  clearly 
demonstrate  the  completeness  and  effectiveness  of  the  Army’s  efforts  to 
resolve  deficiencies  within  planned  time  frames.  Such  steps  would 
include  linking  corrective  actions  on  its  FIP  status  report  to  CAPs 
containing  specific  tasks  required  to  resolve  identified  deficiencies  and 
their  underlying  causes  and  time  frames  for  their  completion.  Without 
such  oversight  of  its  corrective  actions,  the  Army  lacks  needed  assurance 
concerning  whether  efforts  to  achieve  auditability  of  its  SBAs  and  full 
SBRs  will  occur  as  planned. 
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Some  progress  had  been  made  in  completing  Assertion/Evaluation  Phase 
tasks,  including  IPA  examinations  of  the  Army’s  Wave  1  and  2  audit 
readiness  assertions,  and  examination  of  its  Wave  3  assertion  is 
expected  to  be  completed  by  May  2014.  However,  for  actions  taken 
through  June  2013,  when  it  was  completing  its  Wave  3  readiness 
assertion,  we  found  that  the  Army’s  efforts  did  not  effectively  address  the 
FIAR  Guidance  requirements  for  the  Assertion/Evaluation  Phase  tasks  for 
the  budget  execution  FIP  in  assessing  whether  the  reporting  entity  was 
ready  for  an  independent  audit  of  its  readiness  assertion. 

As  defined  by  the  FIAR  Guidance,  the  Assertion/Evaluation  Phase 
comprises  five  tasks:  (1)  the  FIAR  Directorate  evaluates  the 
documentation  to  determine  the  state  of  audit  readiness;  (2)  the  FIAR 
Directorate  provides  feedback  to  the  reporting  entity  on  its  status  of  audit 
readiness;  (3)  reporting  entity  management  asserts  audit  readiness  and 
an  auditor  is  engaged  to  examine  and  identify  any  deficiencies  in  its 
assertion;  (4)  the  reporting  entity  evaluates  the  nature  and  extent  of 
deficiencies  noted  by  the  auditor  on  its  assertion  and  implementation  of 
corrective  actions  to  remediate  them;  and  (5)  the  reporting  entity  verifies 
that  corrective  actions  successfully  remediated  auditor-identified 
deficiencies. 

The  FIAR  Guidance  was  revised  in  March  2013  to  accelerate  the 
involvement  of  IPAs  in  performing  independent  assessments  to  better 
identify  control  deficiencies.  However,  the  guidance  continues  to  require 
reporting  entities  to  perform  procedures  to  verify  that  corrective  action 
plans  were  implemented  and  that  they  successfully  remediated 
deficiencies  prior  to  engaging  an  IPA.  Upon  the  FIAR  Directorate’s  review 
of  readiness  documentation  and  approval  to  proceed  with  an  IPA 
examination,  reporting  entities  are  required  to  prepare  a  written  assertion 
declaring  that  the  subject  matter  to  be  examined  is  audit  ready  in 
conformity  with  the  internal  control  and  supporting  documentation  criteria 
contained  in  the  guidance. 

For  the  Assertion/Evaluation  Phase  tasks,  the  FIAR  Directorate  evaluated 
documentation  supporting  the  Army’s  Wave  2  audit  readiness  assertion, 
and  the  Army  outlined  efforts  to  address  deficiencies  reported  by  an  IPA 
based  on  its  examination  of  the  Army’s  assertion.  However,  we  found  that 
the  Army  did  not  follow  the  FIAR  Guidance  for  Assertion/Evaluation 
Phase  Tasks  2  (FIAR  Directorate  feedback  on  audit  readiness)  and  3 
(reporting  entity  evaluation  of  audit  readiness  assertion)  as  discussed 
below. 


The  Army  Did  Not  Follow 
FIAR  Guidance  in 
Implementing 
Assertion/Evaluation 
Phase  Tasks 
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Feedback  on  Audit  Readiness 
Status  Highlighted  Significant 
Concerns 


Effectiveness  of  the  Army’s 
Audit  Readiness  Assessment 
Was  Unclear 


With  regard  to  task  2  on  providing  feedback  on  the  Army’s  status  of  audit 
readiness,  the  FIAR  Directorate  concluded,  based  on  its  review  of  the  FIP 
for  budget  execution  efforts  contained  in  the  Army’s  Wave  2  assertion 
package  that  Army  commands  within  the  scope  of  the  assertion  were  not 
ready  for  the  type  of  examination  envisioned  under  the  FIAR  Guidance. 
Specifically,  OUSD(C)  noted  in  a  July  2012  memorandum  to  the  Assistant 
Secretary  of  the  Army  (Financial  Management  and  Comptroller)  that  the 
Army’s  testing  indicated  that  (1)  33  percent  of  identified  manual  controls 
were  not  implemented,  31  percent  were  not  tested,  and  1  percent  was 
operating  effectively  and  (2)  30  percent  of  general  and  application 
information  technology  controls  tested  were  operating  effectively.46 
Further,  OUSD(C)  highlighted  other  concerns  in  its  memorandum — such 
as  key  process  and  control  gaps  in  end-to-end  processes,  an  inadequate 
reconciliation  of  complete  populations  of  transactions  to  the  general 
ledger,  and  insufficient  substantive  testing  to  support  general  ledger 
transaction  and  account  balances. 

According  to  the  memorandum,  OUSD(C)  also  noted  that  Army 
representatives  stated  that  corrective  actions  had  been  implemented  and 
controls  were  operating  effectively.  However,  the  Army  had  not  fully 
retested  remediation  actions  because  of  time  constraints  and,  as  a 
consequence,  had  not  provided  evidence  to  demonstrate  effective 
implementation  of  corrective  actions.  Nonetheless,  OUSD(C) 
documentation  indicated  that  it  supported  the  Army’s  efforts  to  proceed  to 
an  I  PA  examination,  in  part,  to  enable  it  to  accelerate  efforts  with  clear 
and  independent  feedback  on  its  approaches,  assumptions,  and 
judgments.  However,  based  on  the  extensive  nature  of  the  deficiencies 
noted  above,  accelerating  these  efforts  prior  to  remediating  them  may  not 
be  cost  effective,  given  the  likelihood  that  an  I  PA  would  identify  similar 
deficiencies  during  its  examination. 

With  regard  to  Task  3  on  assessing  audit  readiness,  the  Army’s  June 
2012  assertion  memorandum  for  Wave  2  stated  that  all  applicable  control 
activities  had  been  effectively  implemented.  However,  specific  information 


46The  memorandum  did  not  specify  whether  percentages  indicated  were  mutually 
exclusive  of  each  other.  General  information  technology  controls  apply  to  all  information 
systems,  including  entity-wide  security  program  planning,  system  software  acquisition  and 
maintenance,  and  access  security.  Application  controls  focus  on  the  processing  of  data 
within  application  software  and  help  ensure  the  completeness,  accuracy,  authorization, 
and  validity  of  transactions  processed. 
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on  the  effectiveness  of  controls  contained  in  its  assertion  package 
indicated  the  existence  of  extensive  deficiencies  and  control  gaps. 
Nevertheless,  the  Army  proceeded  to  have  its  Wave  2  audit  readiness 
assertion  examined  by  an  I  PA  firm  despite  extensive  uncorrected  internal 
control  deficiencies.  In  April  2013,  the  IPA  reported  several  inadequacies 
in  the  Army’s  Wave  2  readiness  assertion.  The  IPA  reported  one  material 
deviation  (the  Army  did  not  identify  all  financial  reporting  objectives  and 
controls  in  GFEBS  and  its  processes  or  complete  end-to-end  process 
reviews  in  accordance  with  the  FIAR  Guidance);  three  material 
weaknesses  (in  GFEBS  information  technology  controls,  journal  voucher 
processing,  and  documentation  supporting  the  design  and  operating 
effectiveness  of  controls);  and  one  significant  deficiency  (in  evidence  of 
internal  control  implementation).  Army  officials  stated  that  the  IPA  exams 
were  beneficial  in  giving  commands  experience  in  undergoing  an  audit. 

However,  an  IPA  exam  to  validate  audit  readiness  assertions  can  be 
costly,  not  only  in  terms  of  IPA  fees,  but  also  in  terms  of  focusing  the 
Army’s  efforts  on  a  validation  process  likely  to  identify  deficiencies 
already  known  to  exist  and  potentially  delaying  efforts  to  remediate  them. 
Accordingly,  conducting  IPA  exams  prior  to  the  Army  taking  steps  to 
verify  that  significant  known  deficiencies  have  been  addressed  is  not  a 
cost-effective  approach  for  achieving  audit  readiness.  To  help  minimize 
the  inefficient  use  of  resources  when  previously  identified  deficiencies 
have  not  been  addressed,  the  NDAA  for  Fiscal  Year  2002  offered  DOD 
some  relief  from  the  cost  and  time  associated  with  preparing  and  auditing 
unreliable  financial  statements.47  Similarly,  redirecting  resources  toward 
addressing  known  deficiencies  rather  than  validating  their  existence  could 
enhance  the  Army’s  ability  to  ensure  the  completeness  and  accuracy  of 
its  audit  readiness  assertion  and  achieve  SBR  auditability  in  a  more  cost- 
effective  and  timely  manner. 


Conclusions 


The  Army  has  made  a  commitment  to  audit  readiness  and  taken  steps  to 
follow  the  FIAR  Guidance.  This  commitment  has  resulted  in  some 
progress  and  helped  to  develop  an  essential  foundation  on  which  further 
progress  can  be  achieved.  However,  in  implementing  its  General  Fund 


47The  NDAA  for  Fiscal  Year  2002,  Pub.  L.  No.  1 07-1 07,  div.  A,  §  1 008  (Dec.  28,  2001 ), 
requires  that  DOD  assess  the  reliability  of  its  financial  statements  each  year  and  report  the 
results  to  the  DOD  OIG  and  others.  If  DOD  asserts  that  a  financial  statement  is  not 
reliable,  DOD  and  the  DOD  OIG  are  required  to  limit  the  work  performed  to  develop, 
compile,  report,  and  audit  the  unreliable  financial  statements. 
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SBR  FIP  for  budget  execution,  the  Army  has  not  completed  tasks 
required  by  the  FIAR  Guidance  to  ensure  that  risks  and  other  key  aspects 
of  its  efforts,  including  business  processes,  key  systems,  and  controls 
that  it  and  its  service  providers  rely  on  to  achieve  audit  readiness,  are 
adequately  documented  and  evaluated.  Also,  extensive  deficiencies 
identified  have  not  been  resolved,  increasing  the  likelihood  that  audit 
readiness  of  the  Army’s  SBR  will  not  be  achieved  as  planned.  DOD’s 
FIAR  Plan  and  Guidance  describe  steps  for  achieving  audit  readiness  of 
its  full  SBR  and  other  financial  statements  by  September  30,  2017,  as 
mandated  by  the  NDAA  of  Fiscal  Year  2010,  as  well  as  incremental  SBA 
readiness  by  September  2014.  However,  the  Army  had  not  documented 
its  assessment  for  how  and  when  its  approach  is  expected  to  achieve  the 
goal  of  producing  an  audit-ready  SBR,  including  risks  related  to  excluding 
steps  to  ensure  the  audit  readiness  of  billions  of  dollars  of  beginning 
balances  and  legacy  system  activity  from  the  scope  of  its  efforts.  Overall, 
the  gaps  and  deficiencies  we  identified  throughout  the  various  phases  of 
the  Army’s  efforts  to  develop  and  implement  its  FIP  for  budget  execution 
were  largely  due  to  its  focus  on  (1)  an  approach  that  emphasizes 
establishing  audit-ready  GFEBS-based  processes  and  (2)  meeting 
scheduled  dates  and  asserting  audit  readiness  before  correcting 
extensive  control  deficiencies.  However,  this  approach  raises  serious 
concerns  regarding  the  reliability  of  the  Army’s  readiness  assertions,  the 
likelihood  that  SBA  and  full  SBR  audit  readiness  will  occur  as  planned, 
and  the  Army’s  ability  to  ensure  the  accuracy  of  financial  information  used 
to  monitor  budgetary  resources  to  achieve  its  mission. 


Recommendations  for 
Executive  Action 


•  identify  activity  attributable  to  assessable  units  associated  with  service 
provider  systems  and  business  processes  having  a  significant  impact 
on  the  Army’s  SBR; 

•  coordinate  efforts  with  service  providers  to  obtain  and  document 
within  MOUs  a  shared  understanding  of  roles  and  responsibilities  for 
processing  Army  data; 

•  identify  and  document  qualitative  risks  and  other  factors,  including 
those  associated  with  the  Army’s  reliance  on  service  provider 
readiness  efforts  as  well  as  other  processes  and  systems  supporting 


T o  improve  the  Army’s  implementation  of  the  FIAR  Guidance  for  its 
General  Fund  SBR  FIP  for  budget  execution  and  facilitate  remaining 
efforts  to  achieve  SBR  auditability,  we  recommend  that  the  Assistant 
Secretary  of  the  Army,  Financial  Management  and  Comptroller,  take  the 
following  10  actions: 
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significant  portions  of  its  SBR  that  the  Army  excluded  from  the  scope 
of  its  readiness  efforts  and  assess  their  potential  impact  on  SBA  and 
full  SBR  auditability  and  established  timelines  required  to  effectively 
achieve  audit  readiness; 

•  update  the  Army’s  determination  for  achieving  SBR  audit  readiness 
included  in  DOD’s  FIAR  Plan  Status  Report  to  address  NDAA 
requirements; 

•  completely  and  accurately  document  the  linkage  of  financial  reporting 
objectives  to  control  activities; 

•  document  criteria  and  processes  for  identifying  key  information 
technology  systems  that  have  a  significant  impact  on  the  Army’s  SBR 
audit  readiness; 

•  obtain  and  assess  the  results  of  service  provider  SSAE  No.  16 
examinations  upon  completion  to  determine  the  adequacy  of  internal 
controls  and  document  complete  end-to-end  business  processes; 

•  update  the  Army’s  FIP  status  reports  to  include  actions  to  address 
identified  deficiencies  related  to  service  providers,  systems,  and  other 
known  issues,  along  with  an  assessment  of  their  severity,  including 
references  to  current  control  activities  with  accurate  estimates  of  the 
completion  status; 

•  link  corrective  actions  and  estimates  for  their  completion  in  FIP  status 
reports  to  (1)  specific  CAP  tasks  to  resolve  deficiencies  and  their 
underlying  causes  and  (2)  dates  for  their  expected  completion;  and 

•  correct  significant  deficiencies  or  material  weaknesses  identified 
before  asserting  audit  readiness  and  engaging  an  I  PA  to  validate  the 
assertion. 


Agency  Comments 
and  Our  Evaluation 


We  provided  a  draft  of  this  report  to  the  Army  for  review  and  comment.  In 
its  written  comments,  reprinted  in  appendix  III,  the  Army  concurred  with 
our  recommendations.  The  Army  also  described  planned  and  ongoing 
actions  that  are  being  taken  in  response  to  our  recommendations.  These 
actions  include  identifying  and  defining  service  providers’  responsibilities, 
systems,  and  controls;  assessing  risks  and  additional  feeder  systems; 
and  updating  its  FIP  status  reports  to  accurately  reflect  the  status  of  its 
current  and  planned  efforts.  Generally,  these  actions,  if  effectively 
implemented,  will  help  improve  the  Army’s  implementation  of  its  General 
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Fund  SBR  FIP  for  budget  execution  and  facilitate  remaining  efforts  to 
achieve  SBR  audit  readiness. 

The  Army’s  comments  did  not  fully  address  our  recommendation  that  the 
Army  update  its  determination  for  achieving  SBR  audit  readiness  included 
in  DOD’s  FIAR  Plan  Status  Report.  Specifically,  as  indicated  in  its 
comments,  the  Army’s  Chief  Management  Officer’s  determination 
included  in  the  May  2014  FIAR  Plan  Status  Report  stated  that  most  of  the 
Army  is  well  postured  to  achieve  audit  readiness  of  the  Schedule  of 
Budgetary  Activity  by  September  30,  2014.  The  Schedule  of  Budgetary 
Activity  is  expected  to  reflect  the  amount  of  budgetary  resources  and 
associated  activity  related  only  to  funding  approved  on  or  after  October  1 , 
2014,  and  therefore  represents  an  incremental  step  building  toward  an 
audit-ready  SBR.  As  discussed  in  our  report,  the  NDAA  for  Fiscal  Year 
2013  included  requirements  for  the  FIAR  Plan  Status  Report  to  include  a 
determination  by  the  Chief  Management  Officer  of  each  military 
department  concerning  its  ability  to  achieve  an  auditable  SBR  by 
September  30,  2014,  and,  if  unable  to  meet  this  deadline,  provide  an 
explanation  as  to  why  it  is  unable  to  meet  the  deadline  as  well  as  an 
alternative  deadline  and  a  description  of  the  plan  for  achieving  an 
auditable  SBR  by  the  alternative  deadline.  The  Army’s  response  did  not 
address  the  deadline  for  full  SBR  auditability,  and  the  May  2014  FIAR 
Plan  Status  Report  does  not  presently  comply  with  the  NDAA 
requirements.  Updating  the  FIAR  Plan  Status  Report  as  required  would 
provide  Congress  and  DOD  decision  makers  with  important  information 
on  DOD’s  progress  toward  meeting  auditability  and  financial  management 
improvement  goals. 


We  are  sending  copies  of  this  report  to  the  Secretary  of  Defense,  the 
Under  Secretary  of  Defense  (Comptroller),  the  Secretary  of  the  Army,  and 
the  Chief  Management  Officer  of  the  Army.  In  addition,  the  report  is 
available  at  no  charge  on  the  GAO  website  at  http://www.gao.gov. 

If  you  or  your  staff  have  any  questions  about  this  report,  please  contact 
me  at  (202)  512-9869  or  khana@gao.gov.  Contact  points  for  our  Offices 
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of  Congressional  Relations  and  Public  Affairs  may  be  found  on  the  last 
page  of  this  report.  GAO  staff  who  made  key  contributions  to  this  report 
are  listed  in  appendix  IV. 


Director 

Financial  Management  and  Assurance 
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Appendix  I:  Objectives,  Scope,  and 
Methodology 


The  objectives  of  our  review  were  to  determine  the  extent  to  which  the 
Army  developed  and  implemented  its  General  Fund  Statement  of  Budget 
Resources  (SBR)  financial  improvement  plan  (FIP)  for  budget  execution 
in  accordance  with  the  Financial  Improvement  and  Audit  Readiness 
(FIAR)  Guidance  with  regard  to  (1)  determining  the  scope  of  activities 
included  in  the  FIP  and  (2)  completing  those  activities  included  in  the 
scope  of  the  FIP.  To  address  our  objectives,  we  reviewed  the  Department 
of  Defense  (DOD)  FIAR  Guidance  and  selected  provisions  of  the  National 
Defense  Authorization  Acts  (NDAA)  for  fiscal  years  2013  and  2010  to 
understand  the  methodology  the  Army  is  required  to  use,  and  related 
responsibilities,  for  achieving  audit  readiness.1  We  analyzed  the  Army’s 
FIP  to  determine  whether  it  contained  elements,  such  as  audit  readiness 
tasks,  required  by  the  FIAR  Guidance  for  the  portions  of  the  Discovery, 
Corrective  Action,  and  Assertion/Evaluation  Phases  completed  at  the  time 
of  our  review.  The  Army  plans  to  address  tasks  required  by  the  FIAR 
Guidance  for  the  Validation  and  Audit  Phases  after  June  2014.  Appendix 
II  provides  specific  information  on  the  phases,  tasks,  and  deliverables 
required  by  the  FIAR  Guidance  for  reporting  entities  to  include  in  their 
FIPs. 

We  also  analyzed  the  SBR  FIP  deliverables  required  by  the  FIAR 
Guidance,  such  as  process  narratives  and  flowcharts,  internal  control 
assessments,  and  test  results  as  well  as  results  of  independent  public 
accountant  examinations  of  the  Army’s  audit  readiness  efforts.  We 
analyzed  other  documentation,  such  as  DOD  FIAR  Plan  Status  Reports, 
the  Army’s  Audit  Readiness  Strategy,  and  periodic  leadership  briefs  and 
presentations,  to  understand  the  Army’s  approach  for  achieving  General 
Fund  SBR  budget  execution  audit  readiness  and  high-level  efforts  to 
monitor  and  manage  progress  and  risks,  and  to  determine  whether  the 
Army’s  FIP  accurately  reflected  the  status  of  tasks  required  to  achieve 
audit  readiness. 

We  interviewed  the  Army’s  General  Fund  Audit  Readiness  Director 
responsible  for  the  Army’s  General  Fund  SBR  FIP  for  budget  execution 


1The  NDAA  for  Fiscal  Year  2010,  Pub.  L.  No.  111-84,  div.  A,  §  1003(a)  (Oct.  28,  2009), 
requires  that  the  DOD  FIAR  Plan  describe  the  actions  and  costs  associated  with  ensuring 
that  DOD  validate  (certify)  that  its  consolidated  financial  statements  are  ready  for  audit  by 
September  30,  2017.  Further,  the  NDAA  for  Fiscal  Year  2013,  Pub.  L.  No.  112-239,  div.  A, 
§  1005(a)  (Jan.  2,  2013),  amended  this  provision  to  require  that  the  FIAR  Plan’s 
descriptions  also  cover  ensuring  that  DOD’s  consolidated  SBR  is  validated  as  ready  for 
audit  no  later  than  September  30,  2014. 
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and  Army  representatives  supporting  these  efforts,  as  well  as  officials  in 
the  Office  of  the  Under  Secretary  of  Defense  (Comptroller),  FIAR 
Directorate,  and  Defense  Finance  and  Accounting  Service,  to  obtain 
explanations  and  clarifications  associated  with  our  evaluation  of  the 
documentation. 

We  reviewed  SBR  FIP  and  audit  readiness  issues  at  the  Army  command 
level  by  conducting  on-site  audit  work  and  interviewing  installation 
officials  at  Installation  Management  Command,  Fort  Sam  Houston, 
Texas,  and  Forces  and  Reserve  Commands,  Fort  Bragg,  North  Carolina. 

We  conducted  this  performance  audit  from  June  2012  to  May  2014  in 
accordance  with  generally  accepted  government  auditing  standards. 
Those  standards  require  that  we  plan  and  perform  the  audit  to  obtain 
sufficient,  appropriate  evidence  to  provide  a  reasonable  basis  for  our 
findings  and  conclusions  based  on  our  audit  objectives.  We  believe  that 
the  evidence  obtained  provides  a  reasonable  basis  for  our  findings  and 
conclusions  based  on  our  audit  objectives. 
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Appendix  II:  FIAR  Guidance  for  Reporting 
Entities 


Table  1  presents  the  reporting  entity  methodology  in  the  Financial 
Improvement  and  Audit  Readiness  (FIAR)  Guidance,  which  the  Army  is 
required  to  follow  in  implementing  its  financial  improvement  plan  (FIP)  for 
General  Fund  Statement  of  Budget  Resources  budget  execution. 


Table  1 :  Reporting  Entity  Methodology  for  Supporting  Audit  Readiness  Included  in  DOD’s  FIAR  Guidance 


FIAR  Guidance  phases  and  tasks 

Required  deliverables 

Discovery  Phase  tasks 

1 .  The  reporting  entity  performs  statement  to  process  analysis 
(i.e.,  the  identification  of  assessable  units,  business  processes, 
systems,  and  other  characteristics  associated  with  amounts 
reported  in  financial  statement  line  items),  to  include  activities 
such  as  developing  and  documenting 

•  a  process  and  system  drilldown  depicting  asset/transaction 
classes,  underlying  processes,  assessable  units  and  subunits, 
and  associated  systems,  including  “as-is”  and  any  planned 
“to-be”  environments,  and 

•  quantitative  and  qualitative  drilldowns  depicting  the  dollar 
activity  (or  balances)  resulting  from  assessable  units  and 
subunits. 

•  Statement  to  process  analysis  and  drilldowns. 

2.  The  reporting  entity  prioritizes  audit  readiness  efforts,  to  include 

•  Assessable  unit  and  audit  readiness  strategy 

activities  such  as 

•  ranking  each  assessable  unit  in  order  of  quantitative 
materiality  and  developing  a  list  of  qualitative  risks  or 
factors  affecting  audit  readiness, 

•  documenting  audit  readiness  strategy,  and 

•  developing  a  systems  inventory  list  to  include  all  current  and 
future  systems. 

document;  systems  inventory. 
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FIAR  Guidance  phases  and  tasks 


Required  deliverables 


3.  The  reporting  entity  documents  processes  and  assesses/tests 

controls,  to  include  activities  such  as  the  following: 

•  Preparing  process  and  system  documentation  to  include 
narratives,  flowcharts,  risk  assessments,  and  internal  control 
worksheets  documenting  financial  statement  assertion  risks, 
financial  reporting  objectives,  control  activities  (manual  and 
automated),  and  information  technology  general  computer 
controls  for  significant  systems,  applications  or 
microapplications,  system  certifications/accreditations,  system 
and  end  user  locations,  and  descriptions  of  hardware,  software, 
and  interfaces. 

•  Planning  and  executing  internal  control  testing  to  obtain 
evidence  about  the  achievement  of  control  objectives  and 
assess  the  effectiveness  of  controls  that  would  prevent  or 
detect  potential  misstatements  in  financial  statements,  and 
summarizing  and  evaluating  results  and  classifying  identified 
deficiencies. 

•  Submitting  an  annual  Internal  Control  over  Financial  Reporting 
(ICOFR)  Statement  of  Assurance  (SOA)  memorandum  and 
material  weakness  Corrective  Action  Plan  (CAP)  summary 
based  on  test  results. 


Process  and  system  documentation  narratives  and 
flowcharts  describing  the  end-to-end  process  for  an 
assessable  unit;  internal  control  assessments. 


Test  plans  and  results,  updated  control  assessments, 
and  classification  of  identified  deficiencies. 


Annual  ICOFR  SOA  memorandum  and  material 
weakness  CAP  summary. 


4.  The  reporting  entity  evaluates  supporting  documentation,  including 
activities  to  prepare  the  population,  data  mine,  identify  and  document 
supporting  documentation,  test  existence  of  documentation 
supporting  transactions  and  balances,  and  summarize  and  report 
test  results. 

Populations  and  reconciliations,  data  mining  results, 
criteria  matrices,  aging  analysis,  test  plans  and  test 
results,  and  evaluation  and  reporting  of  test  results. 

Corrective  Action  Phase  tasks 

1.  The  reporting  entity  designs  audit-ready  environment,  including 
requirements  for  remediating  deficiencies  in  control  activities  and 
supporting  documentation. 

“To-be”  process  flows  and  narratives  with  description 
of  how  documentation  deficiencies  will  be  resolved. 

2.  The  reporting  entity  develops  CAPs  to  resolve  deficiencies  identified 
during  the  Discovery  Phase,  including  efforts  to  update  the  corrective 
action  section  of  the  FIP  to  include  the  classification  of  the 
deficiencies  (material  weakness,  significant  deficiency,  or  control 
deficiency). 

CAP;  updated  FIP. 

3.  The  reporting  entity  develops  resource  requirements,  including 
estimates  of  funding  and  staffing  required  to  execute  CAPs. 

Budget  estimates  and  justifications. 

4.  The  reporting  entity  executes  CAPs  to  reflect  progress  and 
accomplishments,  including  any  scope  and  timeline  changes, 
and  verifies  that  deficiencies  have  been  successfully  remediated. 

Updated  FIP. 

5.  The  reporting  entity  notifies  the  FIAR  Directorate  of  implementation 
and  readiness  for  examination. 

Notification  to  the  FIAR  Directorate  of  CAP 
implementation. 

Assertion/Evaluation  Phase  tasks 

1.  The  FIAR  Directorate  evaluates  the  reporting  entity’s  FIP 

documentation  to  assess  whether  the  reporting  entity  is  ready  for  an 
audit. 

Reporting  entity  FIP  documentation. 

2.  The  FIAR  Directorate  provides  feedback  to  the  reporting  entity  on  its  • 
status  of  audit  readiness. 

Results  of  the  FIAR  Directorate  review. 
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FIAR  Guidance  phases  and  tasks  Required  deliverables 

3.  If  ready  for  audit,  the  reporting  entity  asserts  readiness  in  a  •  Reporting  entity’s  management  assertion  letter;  IPA 

management  assertion  letter  and  the  FIAR  Directorate  engages  an  or  DOD  OIG  examination  report, 

independent  public  accountant  (IPA)  or  the  Department  of  Defense 
(DOD)  Office  of  Inspector  General  (OIG)  to  perform  an  examination 
of  the  reporting  entity’s  readiness  assertion,  and  the  auditor  identifies 
any  deficiencies. 


4.  The  reporting  entity  evaluates  deficiencies  identified  by  the  IPA  or 

DOD  OIG  and  implements  corrective  actions  to  remediate  them. 

Updated  FIP. 

5.  The  reporting  entity  verifies  that  corrective  actions  successfully 
remediated  auditor-identified  deficiencies. 

Updated  FIP. 

Validation  Phase  tasks 

1 .  The  reporting  entity  submits  additional  documentation  to  the  FIAR 
Directorate  demonstrating  that  deficiencies  identified  by  the  auditors 
have  been  successfully  remediated  and  audit  readiness  has  been 
achieved. 

Documentation  demonstrating  remediation  of 
deficiencies. 

2.  The  FIAR  Directorate  reviews  the  examination  report  and  additional 
documentation  demonstrating  remediation  of  deficiencies  and  makes 
a  final  determination  of  the  reporting  entity’s  audit  readiness  state. 

FIAR  Directorate’s  final  determination  of  audit 
readiness. 

Audit  Phase  tasks 

1 .  The  FIAR  Directorate  engages  an  IPA  or  DOD  OIG  to  perform  annual  • 
audits. 

Procurement  contract. 

2.  The  reporting  entity  supports  the  audit  process. 

Engagement  letter. 

3.  The  auditor  issues  an  audit  opinion. 

Audit  opinion. 

Source:  DOD  FIAR  Guidance,  March  2013. 
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SAFM-ZA 


DEPARTMENT  OF  THE  ARMY 

OFFICE  OF  THE  ASSISTANT  SECRETARY  OF  THE  ARMY 
FINANCIAL  MANAGEMENT  AND  COMPTROLLER 
109  ARMY  PENTAGON 
WASHINGTON  DC  20310-0109 


MEMOFtANDUM  FOR  Government  Accountability  Office,  441  G  Street,  NW, 
Washington,  DC  20548 

SUBJECT:  Army  Response  to  the  Government  Accountability  Office  Draft  Report 
(GAO-14-60)  issued  18  April  2014 


1 ,  Enclosed  please  find  the  Army  response  to  recommendations  in  the  Government 
Accountability  Office  (GAO)  Draft  Report  on  Department  of  Defense  (DoD)  Financial 
Management. 


2.  The  point  of  contact  for  this  action  is  Mr.  Thomas  C.  Steffens.  He  can  be  reached  by 
e-mai!  at  thomas.c.steffens2.civ@mail.mil  or  by  telephone  at  703-601-0512. 
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GAO  DRAFT  REPORT  DATED  APRIL  18, 2014 
GAO-14-60  (GAO  CODE  197122) 

“DOD  Financial  Management:  Improvements  Needed  in  Army’s  Efforts  for 
Ensuring  the  Reliability  of  Its  Statement  of  Budgetary  Resources” 

DEPARTMENT  OF  DEFENSE  COMMENTS 
TO  THE  GAO  RECOMMENDATION 


Recommendation  1:  The  GAO  recommends  that  the  Assistant  Secretary  of  the  Army,  Financial 
Management  and  Comptroller  identify  activity  attributable  to  assessable  units  associated  with 
service  provider  systems  and  business  processes  having  a  significant  impact  on  the  Army’s  SBR 

Army  Response:  Concur.  Army  continues  to  work  with  service  providers,  such  as  the  Defense 
Finance  and  Accounting  Service  (DFAS)  and  Defense  Logistics  Agency  (DLA)  to  implement  policies 
and  procedures  for  financial  reporting;  an  example  includes  coordinating  an  automated  solution  with 
DFAS  to  reconcile  the  Army’s  Fund  Balance  with  Treasury  which  significantly  impacts  the  SBR.  In 
preparation  for  Examination  3,  the  Army  identified  each  Service  Provider  and  their  systems  by  business 
process  that  had  a  significant  impact  on  the  Army’s  SBR. 

Recommendation  2:  The  GAO  recommends  that  the  Assistant  Secretary  of  the  Army,  Financial 
Management  and  Comptroller  coordinate  efforts  with  service  providers  to  obtain  and  document 
within  Memorandums  of  Understanding  a  shared  understanding  of  roles  and  responsibilities  for 
processing  Army  data. 

Army  Response:  Concur.  To  date,  Army  updates  and  creates  service  provider  agreements  that 
define  roles,  responsibilities  and  support  for  ongoing  audit  readiness  efforts.  These  agreements 
are  updated  periodically  and  used  as  templates  for  future  coordination  requirements. 

Recommendation  3:  The  GAO  recommends  that  the  Assistant  Secretary  of  the  Army,  Financial 
Management  and  Comptroller  identify  and  document  qualitative  risks  and  other  factors, 
including  those  associated  with  the  Army's  reliance  on  service  provider  readiness  efforts  as  well 
as  other  processes  and  systems  supporting  significant  portions  of  its  SBR  that  the  Army  excluded 
from  the  scope  of  its  readiness  efforts  and  assess  their  potential  impact  on  SBA  and  full  SBR 
auditability  and  established  timeliness  required  to  effectively  achieve  audit  readiness. 

Army  Response:  Concur.  Army  completed  Examination  3  of  its  SBR  by  an  external  auditor 
which  provided  a  list  of  findings  and  recommendations.  The  Army  is  implementing  a 
comprehensive  corrective  action  plan  to  remediate  external  auditor  findings  prior  to  the  FY  201 5 
audit  of  the  SBA.  This  plan  includes  an  assessment  of  risk  and  important  factors  associated  with 
service  provider  coordination  and  systems  supporting  portions  of  the  SBR  in  order  to  take  into 
account  full  scope  audit  readiness  of  Army  business  processes. 

Recommendation  4:  The  GAO  recommends  that  the  Assistant  Secretary  of  the  Army,  Financial 
Management  and  Comptroller  update  the  Army’s  determination  for  achieving  SBR  audit 
readiness  included  in  DOD’S  FIAR  Plan  Status  Report  to  address  NDAA  requirements. 
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Army  Response:  Concur.  The  Army  May  2014  F1AR  Plan  Status  Report  submission  was 
coordinated  with  the  Office  of  the  Under  Secretary  of  Defense  (Comptroller)  to  ensure 
compliance  with  reporting  requirements.  The  Chief  Management  Officer  (CMO)  message  in  the 
May  2014  FIAR  Plan  Status  Report  states  most  of  the  Army  is  well  postured  to  achieve  audit 
readiness  of  the  Schedule  of  Budgetary  activity(SBA)  by  September  30,  2014. 

RECOMMENDATION  5:  The  GAO  recommends  that  the  Assistant  Secretary  of  the  Army, 
Financial  Management  and  Comptroller  completely  and  accurately  document  the  linkage  of 
financial  reporting  objectives  to  control  activities. 

Army  Response:  Concur.  As  part  of  ongoing  audit  readiness  efforts,  the  Army  maintains  a 
catalog  of  internal  controls  associated  with  SBR  business  processes.  The  Army  will  revise  the 
internal  controls  catalog  to  ensure  the  proper  linkage  of  financial  reporting  objectives  and  control 
activities.  Upon  completion  of  Examination  3,  the  IPA  assessed  the  linkage  of  financial  reporting 
objectives  to  control  activities  to  be  a  low/minimal  risk  factor  in  terms  of  receiving  a  clean  audit 
opinion. 

RECOMMENDATION  6:  The  GAO  recommends  that  the  Assistant  Secretary  of  the  Army, 
Financial  Management  and  Comptroller  document  criteria  and  processes  for  identifying  key 
information  technology  systems  that  have  a  significant  impact  on  the  Army’s  SBR  audit 
readiness. 

Army  Response:  Concur.  In  preparation  for  Examination  3,  the  Army  documented  each 
material  feeder  system  and  the  business  process  that  impacts  the  SBR.  The  IPA  performed 
walkthroughs  and  documented  the  exact  feeder  systems  the  Army  had  identified  during  its 
discovery  efforts.  As  a  result  of  this  discovery  the  Army  modified  the  scope  of  the  Examination 
3  to  include  system  assessments  of  1 3  Army  owned  feeder  systems  that  materially  impacted  the 
SBR. 

RECOMMENDATION  7:  The  GAO  recommends  that  the  Assistant  Secretary  of  the  Army, 
Financial  Management  and  Comptroller  obtain  and  assess  the  results  of  service  provider  SSAE 
No.  1 6  examinations  upon  completion  to  determine  the  adequacy  of  internal  controls  and 
document  complete  end-to-end  business  processes. 

Army  Response:  Concur.  As  part  of  Examination  3,  an  IPA  reviewed  all  applicable  service 
provider  SSAE  1 6  documentation  and  identified  findings  and  recommendations  for 
consideration.  As  a  result,  the  Army  will  be  assessing  the  complimentary  end  user  controls  listed 
in  the  SSAE1 6  reports  prior  to  September  30,  2014.  The  Army,  in  coordination  with  OUSD(C) 
FIAR  Directorate,  will  continue  to  coordinate  with  service  providers  to  obtain  and  assess  internal 
control  documentation  for  audit  readiness. 

RECOMMENDATION  8:  The  GAO  recommends  that  the  Assistant  Secretary  of  the  Army, 
Financial  Management  and  Comptroller  update  the  Army’s  FIP  status  reports  to  include  actions 
to  address  identified  deficiencies  related  to  service  providers,  systems,  and  other  known  issues. 
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along  with  an  assessment  of  their  severity,  including  references  to  current  control  activities  with 
accurate  estimates  of  the  completion  status. 

Army  Response:  Concur.  The  Army  will  update  the  PIP  to  account  for  challenges  identified  in 
this  report  and  other  feedback  received  from  the  completion  of  Examination  3.  In  addition,  the 
Army  will  continue  to  track  corrective  actions  from  previous  examinations  leading  up  to  the 
FY  2015  SBA  audit. 

RECOMMENDATION  9:  The  GAO  recommends  that  the  Assistant  Secretary  of  the  Army, 
Financial  Management  and  Comptroller  link  corrective  actions  and  estimates  for  their 
completion  in  FIP  status  reports  to  specific  CAP  tasks  to  resolve  deficiencies  and  their 
underlying  causes  and  dates  for  their  expected  completion. 

Army  Response:  Concur.  The  Army  will  update  the  FIP  to  include  CAP  tasks  and  associated 
completion  dates. 

RECOMMENDATION  10:  The  GAO  recommends  that  the  Assistant  Secretary  of  the  Army, 
Financial  Management  and  Comptroller  correct  significant  deficiencies  or  material  weaknesses 
identified  before  asserting  audit  readiness  and  engaging  an  independent  public  account  to 
validate  the  assertion. 

Army  Response:  Concur.  The  Army  is  implementing  a  comprehensive  corrective  action  plan  to 
remediate  external  auditor  findings  prior  to  the  FY  2015  audit  of  the  SBA.  The  OUSD(C)  FIAR 
Directorate  will  assess  the  Army’s  assertion  of  audit  readiness  and  grant  the  authority  to  engage 
an  IPA  to  validate. 
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The  Government  Accountability  Office,  the  audit,  evaluation,  and 
investigative  arm  of  Congress,  exists  to  support  Congress  in  meeting  its 
constitutional  responsibilities  and  to  help  improve  the  performance  and 
accountability  of  the  federal  government  for  the  American  people.  GAO 
examines  the  use  of  public  funds;  evaluates  federal  programs  and 
policies;  and  provides  analyses,  recommendations,  and  other  assistance 
to  help  Congress  make  informed  oversight,  policy,  and  funding  decisions. 
GAO’s  commitment  to  good  government  is  reflected  in  its  core  values  of 
accountability,  integrity,  and  reliability. 

Obtaining  Copies  of 
GAO  Reports  and 
Testimony 

The  fastest  and  easiest  way  to  obtain  copies  of  GAO  documents  at  no 
cost  is  through  GAO’s  website  (http://www.gao.gov).  Each  weekday 
afternoon,  GAO  posts  on  its  website  newly  released  reports,  testimony, 
and  correspondence.  To  have  GAO  e-mail  you  a  list  of  newly  posted 
products,  go  to  http://www.gao.gov  and  select  “E-mail  Updates.” 

Order  by  Phone 

The  price  of  each  GAO  publication  reflects  GAO’s  actual  cost  of 
production  and  distribution  and  depends  on  the  number  of  pages  in  the 
publication  and  whether  the  publication  is  printed  in  color  or  black  and 
white.  Pricing  and  ordering  information  is  posted  on  GAO’s  website, 
http://www.gao.gov/ordering.htm. 

Place  orders  by  calling  (202)  512-6000,  toll  free  (866)  801-7077,  or 

TDD  (202)512-2537. 

Orders  may  be  paid  for  using  American  Express,  Discover  Card, 
MasterCard,  Visa,  check,  or  money  order.  Call  for  additional  information. 

Connect  with  GAO 

Connect  with  GAO  on  Facebook,  Flickr,  Twitter,  and  YouTube. 

Subscribe  to  our  RSS  Feeds  or  E-mail  Updates.  Listen  to  our  Podcasts. 
Visit  GAO  on  the  web  at  www.gao.gov. 

To  Report  Fraud, 
Waste,  and  Abuse  in 
Federal  Programs 

Contact: 

Website:  http://www.gao.gov/fraudnet/fraudnet.htm 

E-mail:  fraudnet@gao.gov 

Automated  answering  system:  (800)  424-5454  or  (202)  512-7470 

Congressional 

Relations 

Katherine  Siggerud,  Managing  Director,  siggerudk@gao.gov,  (202)  512- 
4400,  U.S.  Government  Accountability  Office,  441  G  Street  NW,  Room 
7125,  Washington,  DC  20548 

Public  Affairs 

Chuck  Young,  Managing  Director,  youngd@gao.gov,  (202)  512-4800 
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